phpBB Multiple Input Validation Vulnerabilities

Bugtraq ID:	9942
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 22 2004 12:00AM
Updated:	Mar 19 2015 09:33AM
Credit:	Discovery is credited to JeiAr <[email protected]>.
Vulnerable:	phpBB Group phpBB 2.0.7 a phpBB Group phpBB 2.0.7 phpBB Group phpBB 2.0.6 d phpBB Group phpBB 2.0.6 c phpBB Group phpBB 2.0.6 phpBB Group phpBB 2.0.5 phpBB Group phpBB 2.0.4 phpBB Group phpBB 2.0.3 phpBB Group phpBB 2.0.2 phpBB Group phpBB 2.0.1 phpBB Group phpBB 2.0 .0 phpBB Group phpBB 2.0 RC4 - Apache Apache 1.3.9 - Apache Apache 1.3.9 phpBB Group phpBB 2.0 RC3 - Apache Apache 1.3.9 - Apache Apache 1.3.9 phpBB Group phpBB 2.0 RC2 - Apache Apache 1.3.9 - Apache Apache 1.3.9 phpBB Group phpBB 2.0 RC1 - Apache Apache 1.3.9 - Apache Apache 1.3.9 phpBB Group phpBB 2.0 Beta 1 - Apache Apache 1.3.9 - Apache Apache 1.3.9 phpBB Group phpBB 1.4.4 - Apache Apache 1.3.9 - Apache Apache 1.3.9 phpBB Group phpBB 1.4.2 - Apache Apache 1.3.9 - Apache Apache 1.3.9 phpBB Group phpBB 1.4.1 phpBB Group phpBB 1.4 .0 phpBB Group phpBB 1.2.1 phpBB Group phpBB 1.2 .0 phpBB Group phpBB 1.0 .0
Not Vulnerable:

phpBB Multiple Input Validation Vulnerabilities

It has been reported that phpBB may be prone to multiple vulnerabilities that could allow an attacker to carry out SQL injection and cross-site scripting attacks. These vulnerabilities result from insufficient sanitization of user-supplied input via the 'id' parameter of 'admin_smilies.php' module and the 'style_id' parameter of 'admin_styles' module.

phpBB versions 2.0.7a and prior are reported to be prone to these issues.

phpBB Multiple Input Validation Vulnerabilities

The following proof of concept has been provided:
admin_smilies.php?mode=edit&id=[SQL]
admin_smilies.php?mode=delete&id=[SQL]
admin_smilies.php?mode=edit&id=[XSS]
admin_smilies.php?mode=delete&id=[XSS]
admin_styles.php?mode=edit&style_id=[SQL]
admin_styles.php?mode=delete&style_id=[SQL]
admin_styles.php?mode=edit&style_id=[XSS]
admin_styles.php?mode=delete&style_id=[XSS]

Further proof of concept can be obtained from the following location:
http://www.gulftech.org/vuln/phpBBpoc/

phpBB Multiple Input Validation Vulnerabilities

Solution:
Third party patches have been provided by JeiAr <[email protected]>. Please note that these patches are not tested by Symantec nor confirmed by the vendor. They can be obtained from:

http://www.gulftech.org/vuln/phpBBadminFix.rar
http://www.gulftech.org/vuln/phpBBpostDeletion.rar
http://www.gulftech.org/vuln/phpBBlogoutFix.rar

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

phpBB Multiple Input Validation Vulnerabilities

References:

• phpBB Homepage (phpBB)
  
• Phpbb 2.0.7a And Earlier Secuity Issues (JeiAr )
  
• Re: Phpbb 2.0.7a And Earlier Secuity Issues (JeiAr )