Vulnerabilities > CVE-2006-4758 - Unspecified vulnerability in PHPbb Group PHPbb 2.0.21

047910
CVSS 4.6 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
SINGLE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
high complexity
phpbb-group
nessus
NVD
Published: 2006-09-13
Updated: 2018-10-17

Summary

phpBB 2.0.21 does not properly handle pathnames ending in %00, which allows remote authenticated administrative users to upload arbitrary files, as demonstrated by a query to admin/admin_board.php with an avatar_path parameter ending in .php%00. Successful exploitation requires that the attacker has Administrative rights.

Vulnerable Configurations

Part Description Count
Application
Phpbb_Group
1

Nessus

  • NASL familyCGI abuses
    NASL idPHPBB_2022.NASL
    descriptionThe version of phpBB installed on the remote host fails to properly block
    last seen2020-06-01
    modified2020-06-02
    plugin id23968
    published2007-01-03
    reporterThis script is Copyright (C) 2007-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/23968
    titlephpBB < 2.0.22 Multiple Vulnerabilities
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1488.NASL
    descriptionSeveral remote vulnerabilities have been discovered in phpBB, a web-based bulletin board. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0471 Private messaging allowed cross site request forgery, making it possible to delete all private messages of a user by sending them to a crafted web page. - CVE-2006-6841 / CVE-2006-6508 Cross site request forgery enabled an attacker to perform various actions on behalf of a logged in user. (Applies to sarge only.) - CVE-2006-6840 A negative start parameter could allow an attacker to create invalid output. (Applies to sarge only.) - CVE-2006-6839 Redirection targets were not fully checked, leaving room for unauthorised external redirections via a phpBB forum. (Applies to sarge only.) - CVE-2006-4758 An authenticated forum administrator may upload files of any type by using specially crafted filenames. (Applies to sarge only.)
    last seen2020-06-01
    modified2020-06-02
    plugin id30227
    published2008-02-11
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/30227
    titleDebian DSA-1488-1 : phpbb2 - several vulnerabilities
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_86526BA453C811DB8F1A000A48049292.NASL
    descriptionSecunia reports : ShAnKaR has discovered a vulnerability in phpBB, which can be exploited by malicious users to compromise a vulnerable system. Input passed to the
    last seen2020-06-01
    modified2020-06-02
    plugin id22502
    published2006-10-05
    reporterThis script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/22502
    titleFreeBSD : phpbb -- NULL byte injection vulnerability (86526ba4-53c8-11db-8f1a-000a48049292)

References