phpBB 'functions.php' Open Redirection Vulnerability
BID:74592
CVE-2015-3880 |Info
phpBB 'functions.php' Open Redirection Vulnerability
| Bugtraq ID: | 74592 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-3880 |
| Remote: | Yes |
| Local: | No |
| Published: | May 12 2015 12:00AM |
| Updated: | May 15 2015 12:13AM |
| Credit: | Mathias Karlsson (avlidienbrunn) |
| Vulnerable: |
phpBB Group phpBB 3.0.8 phpBB Group phpBB 3.0.7 phpBB Group phpBB 3.0.6 phpBB Group phpBB 3.0.5 phpBB Group phpBB 3.0.4 phpBB Group phpBB 3.0.3 phpBB Group phpBB 3.0.2 phpBB Group phpBB 3.0.1 phpBB Group phpBB 3.0 |
| Not Vulnerable: | |
Discussion
phpBB 'functions.php' Open Redirection Vulnerability
phpBB is prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input.
An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.
Versions prior to phpBB 3.0.14 and 3.1.4 are vulnerable.
phpBB is prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input.
An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.
Versions prior to phpBB 3.0.14 and 3.1.4 are vulnerable.
Exploit / POC
phpBB 'functions.php' Open Redirection Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
phpBB 'functions.php' Open Redirection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.