QID 730057

Date Published: 2021-04-26

QID 730057: PHPBB2 Avatar Images Information Disclosure Vulnerability

phpBB2 is an open-source Web forum application that is written in PHP and backended by a number of database products. It runs on most Unix and Linux variants as well as Microsoft Windows.

It has been reported that phpBB2 reveals a user's IP address. This vulnerability was reported for phpBB2 Versions 2.0.0 to 2.0.3. Other versions may also be affected.

This vulnerability is due to phpBB2's file naming scheme for avatar files. Avatar files are typically GIF images files uploaded by users who wish to personalize their posts. When a user uploads an avatar file to a system using phpBB2, the system saves the file with a random name containing the user's IP address, encoded in hexadecimal values, followed by other characters.

QID Detection Logic:
This QID checks for the vulnerable version of PHPBB2.

By exploiting this vulnerability, an attacker can find out user IP addresses on the system hosting phpBB2. This information may be used to launch attacks against users on the system hosting phpBB2 forums.

CVSS V2 rated as Medium - 5 severity.

Solution

Customer are advised upgrade to the latest version PHPBB2.

Vendor References

CVEs related to QID 730057

CVE-2002-2346 |

Software Advisories

Advisory ID	Software	Component	Link
PHPBB			www.phpbb.com/downloads/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].