phpBB 2.0.11, and possibly other versions, with remote avatars and avatar uploading enabled, allows local users to read arbitrary files by providing both a local and remote location for an avatar, then modifying the "Upload Avatar from a URL:" field to reference the target file.

phpBB is vulnerable to remote exploitation of an input validation vulnerability allows attackers to read the contents of arbitrary system files under the privileges of the webserver. This also allows remote attackers to unlink arbitrary system files under the privileges of the webserver.

The remote host is affected by the vulnerability described in GLSA-200503-02 (phpBB: Multiple vulnerabilities)

    It was discovered that phpBB contains a flaw in the session     handling code and a path disclosure bug. AnthraX101 discovered that     phpBB allows local users to read arbitrary files, if the 'Enable remote     avatars' and 'Enable avatar uploading' options are set (CAN-2005-0259).
    He also found out that incorrect input validation in     'usercp_avatar.php' and 'usercp_register.php' makes phpBB vulnerable to     directory traversal attacks, if the 'Gallery avatars' setting is     enabled (CAN-2005-0258).
  Impact :

    Remote attackers can exploit the session handling flaw to gain     phpBB administrator rights. By providing a local and a remote location     for an avatar and setting the 'Upload Avatar from a URL:' field to     point to the target file, a malicious local user can read arbitrary     local files. By inserting '/../' sequences into the 'avatarselect'     parameter, a remote attacker can exploit the directory traversal     vulnerability to delete arbitrary files. A flaw in the 'viewtopic.php'     script can be exploited to expose the full path of PHP scripts.
  Workaround :

    There is no known workaround at this time.

The remote host is running phpBB version 2.0.11 or older.  Such versions suffer from multiple vulnerabilities:

  - full path display on critical messages.
  - full path disclosure in username handling caused by a PHP 4.3.10 bug.
  - arbitrary file disclosure vulnerability in avatar handling functions.
  - arbitrary file unlink vulnerability in avatar handling functions.
  - path disclosure bug in search.php caused by a PHP 4.3.10 bug.
  - path disclosure bug in viewtopic.php caused by a PHP 4.3.10 bug.

The path disclosure vulnerabilities can be exploited by remote attackers to reveal sensitive information about the installation that can be used in further attacks against the target. 

To exploit the avatar handling vulnerabilities, 'Enable gallery avatars' must be enabled on the target (by default, it is disabled) and an attacker have a phpBB account on the target.

The remote host is running phpBB, a web-based forum application written in PHP.  There is a flaw in this version of phpBB that will allow a remote attacker to disclose paths.  This sort of information may be useful for further attacks.
There is another flaw within the usercp_avatar.php script that would allow a remote user to pass arbitrary files to the unlink() function.  The unlink() function deletes files.  A successful attack would delete arbitrary files on the web server.

ID	Name	Product	Family	Severity
18895	FreeBSD : phpbb -- multiple vulnerabilities (326c517a-d029-11d9-9aed-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	medium
17249	GLSA-200503-02 : phpBB: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
17205	phpBB <= 2.0.11 Multiple Vulnerabilities	Nessus	CGI abuses	medium
2641	phpBB < 2.0.12 Path Disclosure / Unauthorized unlink() Function Access	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2005-0259

medium

Tenable Plugins

medium

medium

medium

medium