CVE-2006-2219
- State
- Published
- Severity
- Not scored
- Published
- Feb 8, 2007
- Updated
- Aug 7, 2024
- Reserved
- May 5, 2006
Description
phpBB 2.0.20 does not verify user-specified input variable types before being passed to type-dependent functions, which allows remote attackers to obtain sensitive information, as demonstrated by the (1) mode parameter to memberlist.php and the (2) highlight parameter to viewtopic.php that are used as an argument to the htmlspecialchars or urlencode functions, which displays the installation path in the resulting error message.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- phpbb-multiple-path-disclosure(26306)vdb-entry
- 20060505 phpBB 2.0.20 Full Path Disclosure and SQL Errorsmailing-list
- 20060505 phpBB 2.0.20 Full Path Disclosure and SQL Errorsmailing-list
- 837third-party-advisory
- 20060508 Re: phpBB 2.0.20 Full Path Disclosure and SQL Errorsmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.