icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons_061

phpBB < 2.0.20 Multiple Vulnerabilities

High

Synopsis

The remote host is vulnerable to multiple attack vectors.

Description

According to its banner, the remote host is running a version of phpBB that fails to sanitize BBCode '[IMG]' tags. This can enable an attacker to cause arbitrary HTML and script code to be executed in a user's browser within the context of the affected site. There is also a flaw in the way that phpBB deregisters its global variables. An attacker exploiting this flaw would be able to inject and execute PHP code, execute SQL Injection attacks, and more.

Solution

Upgrade to version 2.0.20 or higher.