phpBB < 2.0.20 Multiple Vulnerabilities
High Nessus Network Monitor Plugin ID 3163
SynopsisThe remote host is vulnerable to multiple attack vectors.
DescriptionAccording to its banner, the remote host is running a version of phpBB that fails to sanitize BBCode '[IMG]' tags. This can enable an attacker to cause arbitrary HTML and script code to be executed in a user's browser within the context of the affected site. There is also a flaw in the way that phpBB deregisters its global variables. An attacker exploiting this flaw would be able to inject and execute PHP code, execute SQL Injection attacks, and more.
SolutionUpgrade to version 2.0.20 or higher.