CVE-2002-1707 — Inclusion of Functionality from Untrusted Control Sphere in Group Phpbb

CWE-829 — Inclusion of Functionality from Untrusted Control SphereCWE-98 — PHP Remote File Inclusion4 documents3 sources
Severity
5.0MEDIUMNVD
EPSS
0.3%
top 43.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Phpbb Group Phpbb
Timeline
PublishedDec 31
Latest updateApr 30

Description

install.php in phpBB 2.0 through 2.0.1, when "allow_url_fopen" and "register_globals" variables are set to "on", allows remote attackers to execute arbitrary PHP code by modifying the phpbb_root_dir parameter to reference a URL on a remote web server that contains the code.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDphpbb_group/phpbb6 versions+5

🔴Vulnerability Details

1
GHSA
GHSA-2jcg-ch57-hfxf: install↗2022-04-30
▶

📐Framework References

2
CWE
Inclusion of Functionality from Untrusted Control Sphere↗
▶
CWE
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')↗
▶