BID:12621

PHPBB Arbitrary File Disclosure Vulnerability

Info

PHPBB Arbitrary File Disclosure Vulnerability

Bugtraq ID:	12621
Class:	Input Validation Error
CVE:	CVE-2005-0259
Remote:	Yes
Local:	No
Published:	Feb 22 2005 12:00AM
Updated:	Mar 19 2015 09:06AM
Credit:	Discovery is credited to AnthraX101 <[email protected]>.
Vulnerable:	phpBB Group phpBB 2.0.11 phpBB Group phpBB 2.0.10 phpBB Group phpBB 2.0.9 phpBB Group phpBB 2.0.8 a phpBB Group phpBB 2.0.8 phpBB Group phpBB 2.0.7 a phpBB Group phpBB 2.0.7 phpBB Group phpBB 2.0.6 d phpBB Group phpBB 2.0.6 c phpBB Group phpBB 2.0.6 phpBB Group phpBB 2.0.5 phpBB Group phpBB 2.0.4 phpBB Group phpBB 2.0.3 phpBB Group phpBB 2.0.2 phpBB Group phpBB 2.0.1 phpBB Group phpBB 2.0 .0 phpBB Group phpBB 2.0 RC4 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 RC3 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 RC2 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 RC1 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 Beta 1 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 Gentoo Linux

Not Vulnerable:	phpBB Group phpBB 2.0.12

Discussion

PHPBB Arbitrary File Disclosure Vulnerability

phpBB is affected by an arbitrary file disclosure vulnerability. This issue arises due to an input validation error allowing an attacker to disclose files in the context of a Web server running the application.

This may allow the attacker to gain access to sensitive data that may be used to carry out further attacks against a vulnerable computer.

A successful attack requires the attacker to have a user account and the presence of some non-default settings allowing for the uploading of remote avatars.

phpBB 2.0.11 and prior versions are affected by this issue.

Exploit / POC

PHPBB Arbitrary File Disclosure Vulnerability

An exploit is not required.

Solution / Fix

PHPBB Arbitrary File Disclosure Vulnerability

Solution:
The vendor has released phpBB 2.0.12 to address this issue.

Gentoo has released advisory GLSA 200503-02 to address various issues in phpBB. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:

emerge --sync
emerge --ask --oneshot --verbose ">=www-apps/phpBB-2.0.13"

phpBB Group phpBB 2.0 RC1