vendor:
phpBB3
by:
RIPS Tech
9.8
CVSS
HIGH
Remote Code Execution
78
CWE
Product Name: phpBB3
Affected Version From: phpBB3 3.2.0
Affected Version To: phpBB3 3.2.7
Patch Exists: YES
Related CWE: N/A
CPE: a:phpbb:phpbb3
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: All
2020
phpBB3 Unauthenticated Remote Code Execution
This exploit allows an unauthenticated attacker to execute arbitrary code on a vulnerable phpBB3 installation. The exploit works by exploiting a vulnerability in the Attachment Settings ACP page, which allows an attacker to upload a malicious ZIP file containing a malicious PHP script. The script is then executed when the server attempts to unzip the file.
Mitigation:
Upgrade to the latest version of phpBB3 and apply all security patches.
