PT-2007-1425 · Phpbb · Phpbb Import Tools Mod

Boecke · Published 2007-03-07 · Updated 2017-10-11 · CVE-2006-7147

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpBB Import Tools Mod versions 0.1.4 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the phpbb root path parameter. This is a result of a PHP remote file inclusion vulnerability in the includes/functions mod user.php file.

Recommendations For versions 0.1.4 and earlier, consider restricting access to the phpbb root path parameter to minimize the risk of exploitation. Avoid using the phpbb root path parameter with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2006-7147

Affected Products

Phpbb Import Tools Mod

References · 4

• 🔥 https://exploit-db.com/exploits/2531 · Exploit
• 🔥 http://securityfocus.com/bid/20525 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-7147 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29512 · Note