PHPBB Admin User Viewed Posts Tracker Module Remote File Include Vulnerability

Bugtraq ID:	20485
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 12 2006 12:00AM
Updated:	Oct 13 2006 04:29PM
Credit:	Ashiyane Corporation is credited with the discovery of this vulnerability.
Vulnerable:	Admin User Viewed Posts Tracker Admin User Viewed Posts Tracker 1.0
Not Vulnerable:	Admin User Viewed Posts Tracker Admin User Viewed Posts Tracker 1.01

PHPBB Admin User Viewed Posts Tracker Module Remote File Include Vulnerability

The phpBB module Admin User Viewed Posts Tracker is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects versions prior to 1.01.

PHPBB Admin User Viewed Posts Tracker Module Remote File Include Vulnerability

An attacker can exploit this issue via a web client.

The following exploit is available:

• /data/vulnerabilities/exploits/20485.pl

PHPBB Admin User Viewed Posts Tracker Module Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

This issue does not affect the latest version 1.01. It is not known at this time if this is an official vendor fix to this issue or a code upgrade.

PHPBB Admin User Viewed Posts Tracker Module Remote File Include Vulnerability

References:

• Admin User Viewed Posts Tracker Download (Nivisec)
  
• Admin User Viewed Posts Tracker Remote File Include Vulnerability ([email protected])