phpBB Unauthorized Administrative Features Access Vulnerability
BID:3171
Info
phpBB Unauthorized Administrative Features Access Vulnerability
| Bugtraq ID: | 3171 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 08 2001 12:00AM |
| Updated: | Mar 19 2015 09:22AM |
| Credit: | Discovered by "David Danier" <[email protected]>. |
| Vulnerable: |
phpBB Group phpBB 1.4.1 phpBB Group phpBB 1.4 .0 phpBB Group phpBB 1.2.1 phpBB Group phpBB 1.2 .0 phpBB Group phpBB 1.0 .0 |
| Not Vulnerable: | |
Discussion
phpBB Unauthorized Administrative Features Access Vulnerability
An input validation error exists in phpBB, a freely available WWW forums package.
The problem is due to improper validation of a variable in the 'bb_profile.php' script included in the package. It may be possible for users registered with the phpBB system to manipulate SQL queries performed by the script and gain access to the package's administrative features.
One consequence of successful exploitation is that the attacker will be privy to user information.
An input validation error exists in phpBB, a freely available WWW forums package.
The problem is due to improper validation of a variable in the 'bb_profile.php' script included in the package. It may be possible for users registered with the phpBB system to manipulate SQL queries performed by the script and gain access to the package's administrative features.
One consequence of successful exploitation is that the attacker will be privy to user information.
Exploit / POC
phpBB Unauthorized Administrative Features Access Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
phpBB Unauthorized Administrative Features Access Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.