Interpretation conflict in phpBB 2.0.17, with remote avatars and avatar uploading enabled, allows remote authenticated users to inject arbitrary web script or HTML via an HTML file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer, which renders malformed image types as HTML, enabling cross-site scripting (XSS) attacks. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer (CVE-2005-3312) and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in phpBB.

Several security related problems have been discovered in drupal, a fully-featured content management/discussion engine. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CVE-2005-3973     Several cross-site scripting vulnerabilities allow     remote attackers to inject arbitrary web script or HTML.

  - CVE-2005-3974     When running on PHP5, Drupal does not correctly enforce     user privileges, which allows remote attackers to bypass     the 'access user profiles' permission.

  - CVE-2005-3975     An interpretation conflict allows remote authenticated     users to inject arbitrary web script or HTML via HTML in     a file with a GIF or JPEG file extension.

Several vulnerabilities have been discovered in phpBB, a fully featured and skinnable flat webforum. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-3310     Multiple interpretation errors allow remote     authenticated users to inject arbitrary web script when     remote avatars and avatar uploading are enabled.

  - CVE-2005-3415     phpBB allows remote attackers to bypass protection     mechanisms that deregister global variables that allows     attackers to manipulate the behaviour of phpBB.

  - CVE-2005-3416     phpBB allows remote attackers to bypass security checks     when register_globals is enabled and the session_start     function has not been called to handle a session.

  - CVE-2005-3417     phpBB allows remote attackers to modify global variables     and bypass security mechanisms.

  - CVE-2005-3418     Multiple cross-site scripting (XSS) vulnerabilities     allow remote attackers to inject arbitrary web scripts.

  - CVE-2005-3419     A SQL injection vulnerability allows remote attackers to     execute arbitrary SQL commands.

  - CVE-2005-3420     phpBB allows remote attackers to modify regular     expressions and execute PHP code via the     signature_bbcode_uid parameter.

  - CVE-2005-3536     Missing input sanitising of the topic type allows remote     attackers to inject arbitrary SQL commands.

  - CVE-2005-3537     Missing request validation permitted remote attackers to     edit private messages of other users.

Multiple vulnerabilities have been reported within phpbb. phpbb is proven vulnerable to :

- script insertion,

- bypassing of protetion mechanisms,

- multiple cross site scripting vulnerabilities,

- SQL injection,

- arbitrary code execution

ID	Name	Product	Family	Severity
22824	Debian DSA-958-1 : drupal - several vulnerabilities	Nessus	Debian Local Security Checks	medium
22791	Debian DSA-925-1 : phpbb2 - several vulnerabilities	Nessus	Debian Local Security Checks	high
21405	FreeBSD : phpbb -- multiple vulnerabilities (28c9243a-72ed-11da-8c1d-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2005-3310

medium

Tenable Plugins

medium

high

high