PHPBB IMG Tag HTML Injection Vulnerability

Bugtraq ID:	12008
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 29 2004 12:00AM
Updated:	Mar 29 2004 12:00AM
Credit:	This vulnerability was reported by the vendor.
Vulnerable:	phpBB Group phpBB 2.0.7 a phpBB Group phpBB 2.0.7
Not Vulnerable:	phpBB Group phpBB 2.0.8

PHPBB IMG Tag HTML Injection Vulnerability

PhpBB is prone to an HTML injection vulnerability. This is due to the application failing to properly sanitize user-supplied input.

The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user.

This issue was reported to affect phpBB version 2.0.7, however, earlier versions may also be vulnerable.

PHPBB IMG Tag HTML Injection Vulnerability

No exploit is required.

PHPBB IMG Tag HTML Injection Vulnerability

Solution:
The vendor has addressed this issue in PhpBB 2.0.8 and later.


phpBB Group phpBB 2.0.7

• phpBB Group phpBB 2.0.11
  http://www.phpbb.com/downloads.php

phpBB Group phpBB 2.0.7 a

• phpBB Group phpBB 2.0.11
  http://www.phpbb.com/downloads.php

PHPBB IMG Tag HTML Injection Vulnerability

References:

• phpBB Changelog (phpBB)
  
• phpBB Homepage (phpBB)