phpBB Page Header Remote Arbitrary Command Execution Vulnerability

Bugtraq ID:	3167
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 31 2001 12:00AM
Updated:	Jul 31 2001 12:00AM
Credit:	Reportedly discovered by "UnderSpell" <[email protected]>, reported to Bugtraq by Joao Gouveia <[email protected]> and <[email protected]>.
Vulnerable:	phpBB Group phpBB 1.4 .0 phpBB Group phpBB 1.2.1 phpBB Group phpBB 1.2 .0 phpBB Group phpBB 1.0 .0
Not Vulnerable:	phpBB Group phpBB 1.4.1

phpBB Page Header Remote Arbitrary Command Execution Vulnerability

An input validation error exists in phpBB, a freely available WWW forums package.

The problem is due to improper validation of some variables in phpBB. It is possible for users registered with the phpBB system to submit values for certain variables used internally by some scripts in the package. An attacker may be able to circumvent the loading of certain values used in the package, and thus be able to submit values of his or her choice.

In the 'page_header.php' script, one such variable is evaluated using PHP's eval() command. As a result, it may be possible for a remote attacker to submit values causing the execution of arbitrary commands on the system running phpBB.

phpBB Page Header Remote Arbitrary Command Execution Vulnerability

Exploit contributed by SPABAM <[email protected]>:

• /data/vulnerabilities/exploits/phpbb.pl

phpBB Page Header Remote Arbitrary Command Execution Vulnerability

References:

• phpBB Homepage (phpBB)