phpBB 2.0.21 does not properly handle pathnames ending in %00, which allows remote authenticated administrative users to upload arbitrary files, as demonstrated by a query to admin/admin_board.php with an avatar_path parameter ending in .php%00.

Several remote vulnerabilities have been discovered in phpBB, a web-based bulletin board. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0471     Private messaging allowed cross site request forgery,     making it possible to delete all private messages of a     user by sending them to a crafted web page.

  - CVE-2006-6841 / CVE-2006-6508     Cross site request forgery enabled an attacker to     perform various actions on behalf of a logged in user.
    (Applies to sarge only.)

  - CVE-2006-6840     A negative start parameter could allow an attacker to     create invalid output. (Applies to sarge only.)

  - CVE-2006-6839     Redirection targets were not fully checked, leaving room     for unauthorised external redirections via a phpBB     forum. (Applies to sarge only.)

  - CVE-2006-4758     An authenticated forum administrator may upload files of     any type by using specially crafted filenames. (Applies     to sarge only.)

The version of phpBB installed on the remote host fails to properly block 'bad' redirection targets.  In addition, it reportedly contains a non-persistent cross-site scripting flaw involving its private messaging functionality and several other issues.  At a minimum, a remote attacker can leverage these flaws to launch cross-site scripting attacks against the affected application.

According to its banner, the remote host is running a version of phpBB that fails to sanitize user-supplied input.  The details of several of these flaws is unknown; however, it is known that one of the vulnerabilities is an HTML injection flaw.  This can enable an attacker to cause arbitrary HTML and script code to be executed in a user's browser within the context of the affected site. 

Secunia reports :

ShAnKaR has discovered a vulnerability in phpBB, which can be exploited by malicious users to compromise a vulnerable system.

Input passed to the 'avatar_path' parameter in admin/admin_board.php is not properly sanitised before being used as a configuration variable to store avatar images. This can be exploited to upload and execute arbitrary PHP code by changing 'avatar_path' to a file with a trailing NULL byte.

Successful exploitation requires privileges to the administration section.

ID	Name	Product	Family	Severity
30227	Debian DSA-1488-1 : phpbb2 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
23968	phpBB < 2.0.22 Multiple Vulnerabilities	Nessus	CGI abuses	critical
3874	phpBB < 2.0.22 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
22502	FreeBSD : phpbb -- NULL byte injection vulnerability (86526ba4-53c8-11db-8f1a-000a48049292)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2006-4758

high

Tenable Plugins

critical

critical

medium

medium