Multiple cross-site scripting (XSS) vulnerabilities in Photo Album 2.0.53 module for phpBB allow remote attackers to inject arbitrary web script or HTML via the bsid parameter to (1) album_cat.php or (2) album_comment.php.

The remote host is running a version of phpBB2 Plus that suffers from multiple cross-site scripting flaws due to a general failure of the application and associated modules to sanitize user-supplied input.

The installed version of phpBB on the remote host includes a photo album module that has multiple vulnerabilities:

  - A SQL Injection Vulnerability     An attacker can pass arbitrary SQL code through the 'mode'     parameter of the 'album_search.php' script to manipulate     database queries.

  - Various Cross-Site Scripting Vulnerabilities     The application fails to properly sanitize user input     through the 'sid' parameter of the 'album_cat.php' and     'album_comment.php' scripts. An attacker can exploit     these flaws to cause arbitrary HTML and script code to     be run in a user's browser within the context of the     affected website.

The remote host is running Photo Album, a phpBB module that enables users to easily share photo albums via the internet.  This version of Photo Album is vulnerable to a SQL injection attack within the 'mode' parameter of the album_search.php script.  An attacker exploiting this flaw would send a malformed query to the album_search.php script which, when processed, would give the attacker the ability to read and/or modify data.  In addition, the attacker may be able to execute arbitrary code.  Photo Album is also vulnerable to a Cross-Site Scripting (XSS) attack within the 'sid' parameter of the album_cat.php and album_comment.php scripts.  An attacker exploiting this flaw would need to convince a user to browse to a malicious URI.  Successful exploitation would result in attacker code running within the victim browser possibly resulting in the loss of confidential data (such as cookies).

The remote host is running phpBB2, a web-based bulletin board written in PHP.  This version of phpBB2 is vulnerable to multiple Cross-Site Scripting (XSS) attacks.  An attacker exploiting this flaw would need to be able to entice a user into browsing a malicious URI.  Successful exploitation would lead to the attacker executing code within the client browser possibly resulting in the theft of confidential data.

ID	Name	Product	Family	Severity
18573	phpBB2 Plus <= 1.52 Multiple XSS	Nessus	CGI abuses : XSS	medium
18051	phpBB Photo Album Module <= 2.0.53 Multiple Vulnerabilities	Nessus	CGI abuses	high
2821	PHP Photo Album < 2.0.14 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high
2820	PHPBB2 < 2.0.14 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2005-1115

medium

Tenable Plugins

medium

high

high

medium