PT-2009-3233 · Phpbb · Pnphpbb2

Staker · Published 2009-02-16 · Updated 2017-09-29 · CVE-2009-0592

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PNphpBB2 versions 1.2i and earlier

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ModName parameter to various PHP files in the admin/ directory, including "admin words.php", "admin groups reapir.php", "admin smilies.php", "admin ranks.php", "admin styles.php", and "admin users.php".

Recommendations For PNphpBB2 versions 1.2i and earlier, consider restricting access to the admin/ directory and its files, such as "admin words.php", "admin groups reapir.php", "admin smilies.php", "admin ranks.php", "admin styles.php", and "admin users.php", to minimize the risk of exploitation. Avoid using the ModName parameter in these files until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-0592

Affected Products

Pnphpbb2

References · 4

• 🔥 https://exploit-db.com/exploits/7658 · Exploit
• 🔥 http://securityfocus.com/bid/33103 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0592 · Security Note
• http://secunia.com/advisories/33365 · Vendor Advisory