QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2004-1315

Back to search

CVE-2004-1315

Published: Dec 31, 2004

Modified: Aug 8, 2024

PUBLISHED

Description

viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.

VendorProductVersions

n/a

n/a

affected
n/a

References

10701
vdb-entry
x_refsource_BID
GLSA-200411-32
vendor-advisory
x_refsource_GENTOO
20041220 phpBB Worm
mailing-list
x_refsource_BUGTRAQ
phpbb-view-sql-injection(18052)
vdb-entry
x_refsource_XF
VU#497400
third-party-advisory
x_refsource_CERT-VN
TA04-356A
third-party-advisory
x_refsource_CERT
13239
third-party-advisory
x_refsource_SECUNIA
20041118 EXEC exploit in phpBB - fix
mailing-list
x_refsource_BUGTRAQ
20041222 Re: phpBB Worm
mailing-list
x_refsource_BUGTRAQ
20041112 phpBB Code EXEC (v2.0.10)
mailing-list
x_refsource_BUGTRAQ

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now