phpBB quick_reply.php SQL Injection

2002-11-13T00:00:00
ID OSVDB:4299
Type osvdb
Reporter Hai Nam Luke(hainamluke@hotmail.com)
Modified 2002-11-13T00:00:00

Description

Vulnerability Description

phpBB Advanced Quick Reply Mod contains a flaw that allows a remote attacker to include arbitrary files in URI requests. The issue is due to a flaw in the way the "quick_reply.php" script fails to validate input to the "phpbb_root_path" variable. If an attacker supplies an arbitrary file from a remote server, it will be processed by the vulnerable phpBB script.

Solution Description

As of [date] there are no known upgrades, patches, or workarounds available to correct this issue.

Short Description

phpBB Advanced Quick Reply Mod contains a flaw that allows a remote attacker to include arbitrary files in URI requests. The issue is due to a flaw in the way the "quick_reply.php" script fails to validate input to the "phpbb_root_path" variable. If an attacker supplies an arbitrary file from a remote server, it will be processed by the vulnerable phpBB script.

References:

Snort Signature ID: 1968 Snort Signature ID: 1967 Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2002-11/0188.html Bugtraq ID: 6173