PT-2006-1689 · Phpbb · Phpbb

Published 2006-02-10 · Updated 2018-10-19 · CVE-2006-0632

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpBB version 2.0.19

Description The issue concerns the generation of activation keys, also known as "validation IDs", which are sent via email when setting up a password. The gen rand string function uses insufficiently random data, making it easier for remote attackers to guess the key. This could allow attackers to modify passwords for existing accounts or create new accounts.

Recommendations For phpBB version 2.0.19, consider updating to a newer version that addresses this issue, as the current implementation of the gen rand string function poses a significant risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-0632

Affected Products

Phpbb

References · 8

• 🔥 http://r-security.net/tutorials/view/readtutorial.php?id=4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0632 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0632 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24573 · Note
• http://secunia.com/advisories/18727 · Note
• http://securityfocus.com/archive/1/424074/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/0461 · Note
• http://osvdb.org/22949 · Note