Certain forms in phpBB before 2.0.22 lack session checks, which has unknown impact and remote attack vectors.

Several remote vulnerabilities have been discovered in phpBB, a web-based bulletin board. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0471     Private messaging allowed cross site request forgery,     making it possible to delete all private messages of a     user by sending them to a crafted web page.

  - CVE-2006-6841 / CVE-2006-6508     Cross site request forgery enabled an attacker to     perform various actions on behalf of a logged in user.
    (Applies to sarge only.)

  - CVE-2006-6840     A negative start parameter could allow an attacker to     create invalid output. (Applies to sarge only.)

  - CVE-2006-6839     Redirection targets were not fully checked, leaving room     for unauthorised external redirections via a phpBB     forum. (Applies to sarge only.)

  - CVE-2006-4758     An authenticated forum administrator may upload files of     any type by using specially crafted filenames. (Applies     to sarge only.)

The version of phpBB installed on the remote host fails to properly block 'bad' redirection targets.  In addition, it reportedly contains a non-persistent cross-site scripting flaw involving its private messaging functionality and several other issues.  At a minimum, a remote attacker can leverage these flaws to launch cross-site scripting attacks against the affected application.

According to its banner, the remote host is running a version of phpBB that fails to sanitize user-supplied input.  The details of several of these flaws is unknown; however, it is known that one of the vulnerabilities is an HTML injection flaw.  This can enable an attacker to cause arbitrary HTML and script code to be executed in a user's browser within the context of the affected site. 

ID	Name	Product	Family	Severity
30227	Debian DSA-1488-1 : phpbb2 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
23968	phpBB < 2.0.22 Multiple Vulnerabilities	Nessus	CGI abuses	critical
3874	phpBB < 2.0.22 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2006-6841

critical

Tenable Plugins

critical

critical

medium