Phpbb Archives - CVE Vulnerability

CVE-2008-7143

Sun, 26 Feb 2023 09:11:53 +0000

phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the Referer header.

The post CVE-2008-7143 appeared first on CVE Vulnerability.

CVE-2008-1565

Sun, 26 Feb 2023 09:09:05 +0000

Directory traversal vulnerability in forum/irc/irc.php in the PJIRC 0.5 module for phpBB allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter.

The post CVE-2008-1565 appeared first on CVE Vulnerability.

CVE-2008-1512

Sun, 26 Feb 2023 09:09:03 +0000

Directory traversal vulnerability in admin/admin_xs.php in eXtreme Styles module (XS-Mod) 2.3.1 and 2.4.0 for phpBB allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the phpEx parameter. NOTE: some of these details are obtained from third party information.

The post CVE-2008-1512 appeared first on CVE Vulnerability.

CVE-2008-1171

Sun, 26 Feb 2023 09:08:53 +0000

** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in the 123 Flash Chat Module for phpBB allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) 123flashchat.php and (2) phpbb_login_chat.php. NOTE: CVE disputes this issue because $phpbb_root_path is explicitly set to “./” in both programs.

The post CVE-2008-1171 appeared first on CVE Vulnerability.

CVE-2007-6223

Sun, 26 Feb 2023 09:08:03 +0000

SQL injection vulnerability in garage.php in phpBB Garage 1.2.0 Beta3 allows remote attackers to execute arbitrary SQL commands via the make_id parameter in a search action in browse mode.

The post CVE-2007-6223 appeared first on CVE Vulnerability.

CVE-2007-5100

Sun, 26 Feb 2023 09:07:31 +0000

Multiple PHP remote file inclusion vulnerabilities in phpBB Plus 1.53, and 1.53a before 20070922, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) language/lang_german/lang_admin_album.php, (2) language/lang_english/lang_main_album.php, and (3) language/lang_english/lang_admin_album.php, different vectors than CVE-2007-5009.

The post CVE-2007-5100 appeared first on CVE Vulnerability.

CVE-2007-2858

Sun, 26 Feb 2023 09:06:29 +0000

SQL injection vulnerability in the IP-Search functionality in the IP-Tracking Mod for phpBB 2.0.x allows remote authenticated administrators to execute arbitrary SQL commands via the Search Query field.

The post CVE-2007-2858 appeared first on CVE Vulnerability.

CVE-2007-1961

Sun, 26 Feb 2023 09:06:05 +0000

PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

The post CVE-2007-1961 appeared first on CVE Vulnerability.

CVE-2007-0761

Sun, 26 Feb 2023 09:05:36 +0000

PHP remote file inclusion vulnerability in config.php in phpBB ezBoard converter (ezconvert) 0.2 allows remote attackers to execute arbitrary PHP code via a URL in the ezconvert_dir parameter.

The post CVE-2007-0761 appeared first on CVE Vulnerability.