PT-2007-3548 · Phpbb Limited · Phpbb

Hackers Pal · Published 2007-04-24 · Updated 2018-10-16 · CVE-2007-2208

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Extreme PHPBB2 version 3.0 Pre Final

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the phpbb root path parameter to (1) functions.php or (2) functions portal.php in includes/.

Recommendations For Extreme PHPBB2 version 3.0 Pre Final, consider restricting access to the functions.php and functions portal.php files in the includes/ directory to minimize the risk of exploitation. Avoid using the phpbb root path parameter in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2007-2208

Affected Products

Phpbb

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-2208 · Security Note
• http://osvdb.org/35421 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33743 · Note
• http://osvdb.org/35420 · Note
• http://securityfocus.com/archive/1/466180/100/0/threaded · Note
• http://securityreason.com/securityalert/2608 · Note