PT-2007-1159 · Phpbb · Phpbb

Cxib8O3 + 1 · Published 2007-02-08 · Updated 2017-07-20 · CVE-2006-2219

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: phpBB version 2.0.20

Description: The issue allows remote attackers to obtain sensitive information by not verifying user-specified input variable types before being passed to type-dependent functions. This is demonstrated by the mode parameter to "memberlist.php" and the highlight parameter to "viewtopic.php", which are used as an argument to functions such as htmlspecialchars or urlencode, resulting in the display of the installation path in the resulting error message.

Recommendations: For phpBB version 2.0.20, consider updating to a newer version that addresses this issue, as the current version does not properly validate user input, leading to potential information disclosure. As a temporary workaround, consider restricting access to the "memberlist.php" and "viewtopic.php" scripts until a patch is available. Avoid using the mode and highlight parameters in these scripts until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2006-2219

Affected Products

Phpbb

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-2219 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26306 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2219 · Note
• http://marc.info/?l=full-disclosure&m=114685931319903&w=2 · Note
• http://securityreason.com/securityalert/837 · Note
• http://marc.info/?l=bugtraq&m=114731067321710&w=2 · Note
• http://marc.info/?l=bugtraq&m=114695651425026&w=2 · Note