PT-2009-5383 · Phpbb · Phpbb

Primehalo · Published 2009-09-03 · Updated 2017-09-19 · CVE-2009-3052

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: phpBB 3 Prime Quick Style addon versions prior to 1.2.3

Description: The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the prime quick style parameter to the "/ucp.php" API endpoint.

Recommendations: For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the /ucp.php endpoint or disabling the prime quick style parameter until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-3052

Affected Products

Phpbb

References · 7

• 🔥 http://phpbb.com/community/viewtopic.php?f=70&t=692625&start=150#p10649315 · Exploit
• 🔥 http://absoluteanime.com/forum/mods/Prime%20Quick%20Style/install.xml · Exploit
• 🔥 https://exploit-db.com/exploits/9569 · Exploit
• 🔥 http://exploit-db.com/exploits/9569 · Exploit
• 🔥 http://securityfocus.com/bid/36214 · Exploit
• http://secunia.com/advisories/36532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3052 · Security Note