phpBB Code EXEC (v2.0.10)

| | | | | | | | || | | | | | | | | |/ / / / | | | / | '| |/ / | | | | V V / | |/ / | | | | | |// // |/ ,|| || http://www.howdark.com ---------------------------------------------------------------------------------------------------------------------------------- // Information...

CVE-2004-1315

viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which...

phpBB viewtopic.php Arbitrary Code Execution

This module exploits two arbitrary PHP code execution flaws in the phpBB forum system. The problem is that the 'highlight' parameter in the 'viewtopic.php' script is not verified properly and will allow an attacker to inject arbitrary code via pregreplace. This vulnerability was introduced in...

exploit in PHPBB 2010

explode: form action="" method="post" URL до форума:input type="text" name="url" size="50" value="http://www.phpbbexample.ru/forum/"br Колличество запросов:select name="select" size="1" option value="10"10/option option value="100"100/option option value="200"200/option option value="500"500/opti...

CVE-2002-1537

The CVE-2002-1537 entry concerns phpBB 2.0.0 where a local attacker can gain administrator privileges by directly calling admin_ug_auth.php with tampered form fields (e.g., u). This is a local privilege escalation affecting phpBB 2.0.0 via the admin_ug_auth.php component, due to manipulated input...

CVE-2002-1537

adminugauth.php in phpBB 2.0.0 allows local users to gain administrator privileges by directly calling adminugauth.php with modifed form fields such as "u"...

CVE-2002-1537: Undefined Security Weakness

adminugauth.php in phpBB 2.0.0 allows local users to gain administrator privileges by directly calling adminugauth.php with modifed form fields such as "u"...

phpBB < 2.0 Multiple Vulnerabilities

Binary data 1729.prm...

phpBB < 3.0.2 Multiple Information Disclosure Vulnerabilities

Binary data 4585.prm...

phpBB Fetch All < 2.0.12 Multiple Scripts SQL Injection

The remote host is running a version of phpBB FetchAll older than 2.0.12. It is reported that this version of phpBB Fetch All is susceptible to a SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input before using it in a SQL query...

CVE-2004-0729

PhpBB 2.0.8 allows remote attackers to gain sensitive information via an invalid 1 categoryrows parameter to index.php, 2 faq parameter to faq.php, or 3 ranksrow parameter to profile.php, which reveal the full path in an error message...

CVE-2004-0730

Multiple cross-site scripting XSS vulnerabilities in PhpBB 2.0.8 allow remote attackers to inject arbitrary web script or HTML via 1 the cattitle parameter in index.php, 2 the faq00 parameter in langfaq.php as accessible from faq.php, or 3 the faq00 parameter in langbbcode.php as accessible from...

phpBB < 2.0.10 Multiple XSS

The remote host is running a version of phpBB older than 2.0.10. phpBB contains a flaw that allows a remote cross-site scripting attack. This flaw exists because the application does not validate user-supplied input in the 'searchauthor' parameter. This version is also vulnerable to an HTTP...

CVE-2004-0730

Multiple cross-site scripting XSS vulnerabilities in PhpBB 2.0.8 allow remote attackers to inject arbitrary web script or HTML via 1 the cattitle parameter in index.php, 2 the faq00 parameter in langfaq.php as accessible from faq.php, or 3 the faq00 parameter in langbbcode.php as accessible from...

CVE-2004-0729

CVE-2004-0729 affects PhpBB 2.0.8. The vulnerability occurs when users supply invalid input via (1) category_rows to index.php, (2) faq to faq.php, or (3) ranksrow to profile.php, triggering error messages that reveal the full server path. The available documents confirm the component and origin ...

CVE-2004-0730

PhpBB 2.0.8 is affected by multiple XSS vulnerabilities (three vectors: cat_title in index.php, faq[0][0] in lang_faq.php as accessible from faq.php, and faq[0][0] in lang_bbcode.php as accessible from faq.php). The underlying issue is unsanitized input leading to remote script/HTML injection. Re...

CVE-2004-0729

PhpBB 2.0.8 allows remote attackers to gain sensitive information via an invalid 1 categoryrows parameter to index.php, 2 faq parameter to faq.php, or 3 ranksrow parameter to profile.php, which reveal the full path in an error message...

CVE-2004-0729: Undefined Security Weakness

PhpBB 2.0.8 allows remote attackers to gain sensitive information via an invalid 1 categoryrows parameter to index.php, 2 faq parameter to faq.php, or 3 ranksrow parameter to profile.php, which reveal the full path in an error message...

CVE-2004-0730: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in PhpBB 2.0.8 allow remote attackers to inject arbitrary web script or HTML via 1 the cattitle parameter in index.php, 2 the faq00 parameter in langfaq.php as accessible from faq.php, or 3 the faq00 parameter in langbbcode.php as accessible from...

PhpBB HTTP Response Splitting & Cross Site Scripting vulnerabilities

///////////////////////////////////////////////////////////////////// //=================== Security Advisory =======================// ///////////////////////////////////////////////////////////////////// --------------------------------------------------------------------- --- PhpBB HTTP Respon...