vendor:
phpBB2 MODificat
by:
xoron
7.5
CVSS
HIGH
Remote File Include
CWE
Product Name: phpBB2 MODificat
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
phpBB2 MODificat (phpbb_root_path) Remote File Include Exploit
This exploit allows an attacker to include a remote file by manipulating the 'phpbb_root_path' parameter in the 'functions.php' file of phpBB2 MODificat. By injecting a malicious URL in the 'phpbb_root_path' parameter, an attacker can execute arbitrary code on the target system.
Mitigation:
The vendor should release a patch that sanitizes user input in the 'phpbb_root_path' parameter to prevent remote file inclusion attacks. In the meantime, users can mitigate the vulnerability by restricting access to the 'functions.php' file or by updating to a patched version of phpBB2 MODificat.
