1. CVE-Search
  2. CVE-2004-1315
ID CVE-2004-1315
Summary viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.
References
Vulnerable Configurations
  • cpe:2.3:a:phpbb_group:phpbb:*:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:*:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:1.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:1.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:1.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:1.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.6c:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.6c:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.6d:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.6d:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.7a:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.7a:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.8a:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.8a:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0_beta1:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0_beta1:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0_rc1:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0_rc1:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0_rc2:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0_rc2:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0_rc3:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0_rc3:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:2.0_rc4:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:2.0_rc4:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 11-07-2017 - 01:30)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 10701
bugtraq
  • 20041112 phpBB Code EXEC (v2.0.10)
  • 20041118 EXEC exploit in phpBB - fix
  • 20041220 phpBB Worm
  • 20041222 Re: phpBB Worm
cert TA04-356A
cert-vn VU#497400
confirm http://www.phpbb.com/phpBB/viewtopic.php?t=240513
gentoo GLSA-200411-32
secunia 13239
xf phpbb-view-sql-injection(18052)
Last major update 11-07-2017 - 01:30
Published 12-11-2004 - 05:00
Last modified 11-07-2017 - 01:30
Back to Top