QwikSec

Security Database

CVE

CWE

Training

CVE-2005-3416

Published: Nov 1, 2005

Modified: Aug 7, 2024

PUBLISHED

Description

phpBB 2.0.17 and earlier, when register_globals is enabled and the session_start function has not been called to handle a session, allows remote attackers to bypass security checks by setting the $_SESSION and $HTTP_SESSION_VARS variables to strings instead of arrays, which causes an array_merge function call to fail.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vdb-entry

x_refsource_OSVDB

20051031 Advisory 17/2005: phpBB Multiple Vulnerabilities

mailing-list

x_refsource_BUGTRAQ

vendor-advisory

x_refsource_DEBIAN

third-party-advisory

x_refsource_SECUNIA

third-party-advisory

x_refsource_SREASON

third-party-advisory

x_refsource_SECUNIA

http://www.hardened-php.net/advisory_172005.75.html

x_refsource_MISC

vdb-entry

x_refsource_SECTRACK

vdb-entry

x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.