phpBB < 3.2.10, 3.3.0 Multiple Vulnerabilities

# SPDX-FileCopyrightText: 2020 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:phpbb:phpbb";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.108847");
  script_version("2026-05-21T06:54:30+0000");
  script_tag(name:"last_modification", value:"2026-05-21 06:54:30 +0000 (Thu, 21 May 2026)");
  script_tag(name:"creation_date", value:"2020-08-13 11:47:22 +0000 (Thu, 13 Aug 2020)");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2020-08-21 18:17:00 +0000 (Fri, 21 Aug 2020)");

  script_cve_id("CVE-2020-8226");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("phpBB < 3.2.10, 3.3.0 Multiple Vulnerabilities");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2020 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_phpbb_http_detect.nasl");
  script_mandatory_keys("phpbb/detected");

  script_tag(name:"summary", value:"phpBB is prone to multiple vulnerabilities.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The following flaws exist:

  - CVE-2020-8226, SECURITY-259:  Previous versions of phpBB did allow limiting the dimensions of
  images posted. This could however also be used to e.g. check for the existence of services that
  should only be accessible from the internal network.

  - SECURITY-257: Potential RCE via Phar Deserialization through Legacy BBCode Parser");

  script_tag(name:"impact", value:"These flaws could be used to e.g. check for the existence of
  services that should only be accessible from the internal network or to execute remote code on
  the affected system.");

  script_tag(name:"affected", value:"phpBB prior to version 3.2.10 and 3.3.0.");

  script_tag(name:"solution", value:"Update to version 3.2.10, 3.3.1 or later.");

  script_xref(name:"URL", value:"https://www.phpbb.com/community/viewtopic.php?f=14&t=2562631");
  script_xref(name:"URL", value:"https://www.phpbb.com/community/viewtopic.php?f=14&t=2562636");
  script_xref(name:"URL", value:"http://tracker.phpbb.com/browse/SECURITY-257");
  script_xref(name:"URL", value:"http://tracker.phpbb.com/browse/SECURITY-259");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if( ! port = get_app_port( cpe:CPE ) )
  exit( 0 );

if( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )
  exit( 0 );

vers = infos["version"];
path = infos["location"];

if( version_is_less( version:vers, test_version:"3.2.10" ) ) {
  report = report_fixed_ver( installed_version:vers, fixed_version:"3.2.10", install_path:path );
  security_message( port:port, data:report );
  exit( 0 );
} else if( version_is_equal( version:vers, test_version:"3.3.0" ) ) {
  report = report_fixed_ver( installed_version:vers, fixed_version:"3.2.10", install_path:path );
  security_message( port:port, data:report );
  exit( 0 );
}

exit( 99 );