Detections
Analytics
phpBB <= 2.0.13 Multiple Vulnerabilities
medium Nessus Plugin ID 17301
Language:
Synopsis
The remote web server contains a PHP application that is affected by multiple vulnerabilities.Description
According to its banner, the remote host is running a version of phpBB that suffers from multiple flaws:- A Path Disclosure Vulnerability A remote attacker can cause phpBB to reveal its installation path via a direct request to the script 'db/oracle.php'.
- A Cross-Site Scripting Vulnerability The application does not properly sanitize user input before using it in 'privmsg.php' and 'viewtopic.php'.
- A Privilege Escalation Vulnerability In 'session.php' phpBB resets the 'user_id' value when an autologin fails; it does not, however, reset the 'user_level' value, which remains as the account that failed the autologin.
Since the software uses the 'user_level' parameter in some cases to control access to privileged functionality, this flaw allows an attacker to view information, and possibly even perform tasks, normally limited to administrators.
- SQL Injection Vulnerabilities The DLMan Pro and LinksLinks Pro mods, if installed, reportedly fail to properly sanitize user input to the 'file_id' parameter of the 'dlman.php' script and the 'id' parameter of the 'links.php' script respectively before using it in a SQL query. This may allow an attacker to pass malicious input to database queries.
Solution
Upgrade to a version after phpBB 2.0.13 and disable the DLMan Pro and LinksLinks Pro mods.See Also
https://seclists.org/bugtraq/2005/Mar/99
https://seclists.org/bugtraq/2005/Mar/113
Plugin Details
Severity: Medium
ID: 17301
File Name: phpbb_userlevel_priv_escalation.nasl
Version: 1.26
Type: remote
Family: CGI abuses
Published: 3/9/2005
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.1
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:phpbb_group:phpbb
Required KB Items: www/phpBB
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Vulnerability Publication Date: 3/3/2005