PT-2006-2766 · Phpbb · Phpbb

Published 2006-04-13 · Updated 2008-09-05 · CVE-2006-1775

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpBB version 2.0.19

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several fields, including the Site Description field in admin board.php, the Group name and Group description fields in admin groups.php and groupcp.php, the Theme Name field in admin styles.php, and the Rank Title field in admin ranks.php.

Recommendations For phpBB version 2.0.19, update to a version that includes a fix for these XSS vulnerabilities to prevent remote attackers from injecting arbitrary web script or HTML. As a temporary workaround, consider restricting access to the affected fields, such as the Site Description field, Group name, Group description, Theme Name, and Rank Title fields, until a patch is available.

Fix

Related Identifiers

CVE-2006-1775

Affected Products

Phpbb

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-1775 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1775 · Note
• http://osvdb.org/24357 · Note
• http://osvdb.org/ref/24/24353-phpbb.txt · Note
• http://osvdb.org/24356 · Note
• http://osvdb.org/24354 · Note
• http://osvdb.org/24355 · Note