Detections
Analytics
phpBB < 2.0.20 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 3163
Synopsis
The remote host is vulnerable to multiple attack vectors.Description
According to its banner, the remote host is running a version of phpBB that fails to sanitize BBCode '[IMG]' tags. This can enable an attacker to cause arbitrary HTML and script code to be executed in a user's browser within the context of the affected site. There is also a flaw in the way that phpBB deregisters its global variables. An attacker exploiting this flaw would be able to inject and execute PHP code, execute SQL Injection attacks, and more.Solution
Upgrade to version 2.0.20 or higher.Plugin Details
Severity: High
ID: 3163
Family: CGI
Published: 8/16/2005
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 7.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:H/RL:U/RC:X
Vulnerability Information
CPE: cpe:/a:phpbb_group:phpbb
Reference Information
CVE: CVE-2005-3415, CVE-2005-3416, CVE-2005-3417, CVE-2005-3418, CVE-2005-3419, CVE-2005-3420, CVE-2005-3536, CVE-2005-3537, CVE-2006-1895