full-disclosure - Security Advisory - phpBB 2.0.15 PHP-code injection bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <38f2c06705062909287d51370f@mail.gmail.com>
Date: Wed Jun 29 17:28:16 2005
From: siegfri3d at gmail.com (Siegfried)
Subject: Security Advisory - phpBB 2.0.15 PHP-code
	injection bug

>Due to a bug in the phpBB highlighting code it's possible to inject
>PHP-code into the running script. E.g. It's possible to run system
>commands if the PHP interpreter allows system() and simular functions.
>This is actually based on an old bug which was improperly fixed in
>phpBB 2.0.11. 

phpBB versions 2.0.11 through 2.0.14 don't seem affected no? it was
rather reintroduced in version 2.0.15 because they changed some things
in this part of the code