PHPBB2 Image Tag HTML Injection Vulnerability

Bugtraq ID:	4858
Class:	Input Validation Error
CVE:	CVE-2002-0902 CVE-2002-0902
Remote:	Yes
Local:	No
Published:	May 26 2002 12:00AM
Updated:	Mar 19 2015 08:46AM
Credit:	Discovery of this issue is credited to Martijn Boerwinkel <[email protected]>.
Vulnerable:	phpBB Group phpBB 2.0 .0 phpBB Group phpBB 2.0 RC4 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 RC3 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 RC2 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 RC1 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 2.0 Beta 1 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9 phpBB Group phpBB 1.4.4 - Apache Software Foundation Apache 1.3.9 - Apache Software Foundation Apache 1.3.9
Not Vulnerable:	phpBB Group phpBB 2.0.1

PHPBB2 Image Tag HTML Injection Vulnerability

Solution:
This issue has been addressed in phpBB2 2.0.1.


phpBB Group phpBB 2.0 Beta 1

• phpBB Group phpBB 2.0.1
  http://www.phpbb.com/downloads.php

phpBB Group phpBB 2.0 RC1

• phpBB Group phpBB 2.0.1
  http://www.phpbb.com/downloads.php

phpBB Group phpBB 2.0 RC3

• phpBB Group phpBB 2.0.1
  http://www.phpbb.com/downloads.php

phpBB Group phpBB 2.0 .0

• phpBB Group phpBB 2.0.1
  http://www.phpbb.com/downloads.php

phpBB Group phpBB 2.0 RC2

• phpBB Group phpBB 2.0.1
  http://www.phpbb.com/downloads.php

phpBB Group phpBB 2.0 RC4

• phpBB Group phpBB 2.0.1
  http://www.phpbb.com/downloads.php

PHPBB2 Image Tag HTML Injection Vulnerability

References:

• CSS in phpBB 1.4.4 ("SandI\]" )