phpBB++ *phpbb_root_path* File Inclusion Vulnerability

Posted on Monday, February 05, 2007 @ 11:09:43 UTC in Security
by Raven

SECUNIA ADVISORY ID: SA24034

VERIFY ADVISORY: http://secunia.com/advisories/24034/

CRITICAL: Highly critical

IMPACT: System access

SOFTWARE: phpBB++ - http://secunia.com/product/13419/

DESCRIPTION: xoron has reported a vulnerability in phpBB++, which can be exploited by malicious people to compromise vulnerable systems.
Input passed to the "phpbb_root_path" parameter in includes/functions.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources. Successful exploitation requires that "register_globals" is enabled. The vulnerability is reported in Build 101. Other versions may also be affected.

SOLUTION: Edit the source code to ensure that input is properly verified.

PROVIDED AND/OR DISCOVERED BY: xoron

ORIGINAL ADVISORY: http://milw0rm.com/exploits/3259
 
 
click Related        click Share
 
News ©

Site Info

Last SeenLast Seen
  • neralex
  • nextgen
Server TrafficServer Traffic
  • Total: 481,639,165
  • Today: 6,467
Server InfoServer Info
  • Mar 29, 2024
  • 05:32 am UTC