A "missing request validation" error in phpBB 2 before 2.0.18 allows remote attackers to edit private messages of other users, probably by modifying certain parameters or other inputs.

Several vulnerabilities have been discovered in phpBB, a fully featured and skinnable flat webforum. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-3310     Multiple interpretation errors allow remote     authenticated users to inject arbitrary web script when     remote avatars and avatar uploading are enabled.

  - CVE-2005-3415     phpBB allows remote attackers to bypass protection     mechanisms that deregister global variables that allows     attackers to manipulate the behaviour of phpBB.

  - CVE-2005-3416     phpBB allows remote attackers to bypass security checks     when register_globals is enabled and the session_start     function has not been called to handle a session.

  - CVE-2005-3417     phpBB allows remote attackers to modify global variables     and bypass security mechanisms.

  - CVE-2005-3418     Multiple cross-site scripting (XSS) vulnerabilities     allow remote attackers to inject arbitrary web scripts.

  - CVE-2005-3419     A SQL injection vulnerability allows remote attackers to     execute arbitrary SQL commands.

  - CVE-2005-3420     phpBB allows remote attackers to modify regular     expressions and execute PHP code via the     signature_bbcode_uid parameter.

  - CVE-2005-3536     Missing input sanitising of the topic type allows remote     attackers to inject arbitrary SQL commands.

  - CVE-2005-3537     Missing request validation permitted remote attackers to     edit private messages of other users.

Multiple vulnerabilities have been reported within phpbb. phpbb is proven vulnerable to :

- script insertion,

- bypassing of protetion mechanisms,

- multiple cross site scripting vulnerabilities,

- SQL injection,

- arbitrary code execution

The remote host is running a version of phpBB that, if using PHP 5 with 'register_globals' enabled, fails to properly deregister global variables as well as failing to initialize several variables in various scripts.  An attacker may be able to exploit these issues to execute arbitrary code or to conduct SQL injection and cross-site scripting attacks.

According to its banner, the remote host is running a version of phpBB that fails to sanitize BBCode '[IMG]' tags.  This can enable an attacker to cause arbitrary HTML and script code to be executed in a user's browser within the context of the affected site. There is also a flaw in the way that phpBB deregisters its global variables.  An attacker exploiting this flaw would be able to inject and execute PHP code, execute SQL Injection attacks, and more. 

ID	Name	Product	Family	Severity
22791	Debian DSA-925-1 : phpbb2 - several vulnerabilities	Nessus	Debian Local Security Checks	high
21405	FreeBSD : phpbb -- multiple vulnerabilities (28c9243a-72ed-11da-8c1d-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	high
20132	phpBB <= 2.0.17 Multiple Vulnerabilities	Nessus	CGI abuses	high
3163	phpBB < 2.0.20 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2005-3537

medium

Tenable Plugins

high

high

high

high