vendor:
PHPBB
by:
[Oo]
7,5
CVSS
HIGH
Remote File Inclusion
98
CWE
Product Name: PHPBB
Affected Version From: PHPBB <= 1.3.8
Affected Version To: PHPBB <= 1.3.8
Patch Exists: YES
Related CWE: N/A
CPE: a:phpbb:phpbb:1.3.8
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2006
TopList Hack for PHPBB <= 1.3.8 Remote File Inclusion
The vulnerability exists due to insufficient sanitization of user-supplied input in the 'f' and 'phpbb_root_path' parameters of the 'toplist.php' script. This can be exploited to include arbitrary files from remote hosts and execute arbitrary PHP code.
Mitigation:
Input validation should be used to prevent the inclusion of remote files.
