phpBB2 Unauthorized Administrative Access Vulnerability

Bugtraq ID:	6056
Class:	Input Validation Error
CVE:	CVE-2002-1537
Remote:	Yes
Local:	No
Published:	Oct 28 2002 12:00AM
Updated:	Jul 11 2009 06:06PM
Credit:	Discovery of this vulnerability is credited to Rootsecure.net.
Vulnerable:	phpBB Group phpBB 2.0 .0
Not Vulnerable:	phpBB Group phpBB 2.0.3 phpBB Group phpBB 2.0.2 phpBB Group phpBB 2.0.1

phpBB2 Unauthorized Administrative Access Vulnerability

A vulnerability has been discovered in phpBB2 which may allow an unauthorized attacker to gain administrative privileges.

By sending a maliciously constructed post to a vulnerable forum resource, it is possible for an unauthorized user to grant 'administrator' privileges to arbitrary users.

Exploiting this issue could allow a remote attacker to gain complete control of a target forum.

It has been reported that third party utilities that use phpBB v2.0.0 may also be vulnerable to this issue.

phpBB2 Unauthorized Administrative Access Vulnerability

Solution:
It has been reported that versions later than v2.0.0 are not vulnerable to this issue.

Fixes available:


phpBB Group phpBB 2.0 .0

• phpBB Group phpBB 2.0.1
  http://www.phpbb.com/downloads.php


• phpBB Group phpBB 2.0.2
  http://www.phpbb.com/downloads.php


• phpBB Group phpBB 2.0.3
  http://www.phpbb.com/downloads.php

phpBB2 Unauthorized Administrative Access Vulnerability

References: