GLSA-200411-32 : phpBB: Remote command execution

High Nessus Plugin ID 15826


The remote Gentoo host is missing one or more security-related patches.


The remote host is affected by the vulnerability described in GLSA-200411-32 (phpBB: Remote command execution)

phpBB contains a vulnerability in the highlighting code and several vulnerabilities in the username handling code.
Impact :

An attacker can exploit the highlighting vulnerability to access the PHP exec() function without restriction, allowing them to run arbitrary commands with the rights of the web server user (for example the apache user). Furthermore, the username handling vulnerability might be abused to execute SQL statements on the phpBB database.


All phpBB users should upgrade to the latest version to fix all known vulnerabilities:
# emerge --sync # emerge --ask --oneshot --verbose '>=www-apps/phpbb-2.0.11'

See Also

Plugin Details

Severity: High

ID: 15826

File Name: gentoo_GLSA-200411-32.nasl

Version: $Revision: 1.14 $

Type: local

Published: 2004/11/24

Modified: 2017/08/14

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Temporal Score: 7.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:ND/RC:ND

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:phpbb, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2004/11/24

Vulnerability Publication Date: 2004/11/18

Exploitable With

Metasploit (phpBB viewtopic.php Arbitrary Code Execution)

Reference Information

CVE: CVE-2004-1315

OSVDB: 11961, 11962

GLSA: 200411-32