CVE-2004-1315
- State
- Published
- Severity
- Not scored
- Published
- Dec 31, 2004
- Updated
- Aug 8, 2024
- Reserved
- Dec 22, 2004
Description
viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 10701vdb-entry
- GLSA-200411-32vendor-advisory
- 20041220 phpBB Wormmailing-list
- phpbb-view-sql-injection(18052)vdb-entry
- http://www.phpbb.com/phpBB/viewtopic.php?t=240513
- VU#497400third-party-advisory
- TA04-356Athird-party-advisory
- 13239third-party-advisory
- 20041118 EXEC exploit in phpBB - fixmailing-list
- 20041222 Re: phpBB Wormmailing-list
- 20041112 phpBB Code EXEC (v2.0.10)mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.