Detections
Analytics
phpBB < 2.0.7 Multiple Script SQL Injection
high Nessus Plugin ID 11938
Language:
Synopsis
A remote web application is vulnerable to SQL injection.Description
The remote host is running a version of phpBB older than 2.0.7.There is a flaw in the remote software that could allow anyone to inject arbitrary SQL commands, which may in turn be used to gain administrative access on the remote host or to obtain the MD5 hash of the password of any user.
Solution
Upgrade to version 2.0.7 or later.Plugin Details
Severity: High
ID: 11938
File Name: phpbb_sql_injection2.nasl
Version: 1.28
Type: remote
Family: CGI abuses
Published: 12/4/2003
Updated: 6/4/2024
Configuration: Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:phpbb_group:phpbb
Required KB Items: www/phpBB
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Vulnerability Publication Date: 11/27/2003
Reference Information
CVE: CVE-2003-1215, CVE-2003-1216