Detections
Analytics

phpBB < 2.0.9 Multiple Vulnerabilities

high Nessus Plugin ID 13655

Language:

Synopsis

A remote web application is vulnerable to SQL injection.

Description

The remote host is running a version of phpBB older than 2.0.9.

There is a flaw in the remote software that may allow anyone to inject arbitrary SQL commands, which may in turn be used to gain administrative access on the remote host or to obtain the MD5 hash of the password of any user.

One vulnerability is reported to exist in 'admin_board.php'. The other pertains to improper characters in the session id variable.

Solution

Upgrade to 2.0.9

Plugin Details

Severity: High

ID: 13655

File Name: phpbb_sql_injection3.nasl

Version: 1.21

Type: remote

Family: CGI abuses

Published: 7/21/2004

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:phpbb_group:phpbb

Required KB Items: www/phpBB

Exploit Available: true

Exploit Ease: No exploit is required

Vulnerability Publication Date: 7/13/2004

Reference Information

BID: 10722