CVE

Id
9743  
CVE No.
CVE-2004-1315  
Status
Candidate  
Description
viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.  
Phase
Assigned (20041222)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
66120 9743 CVE-2004-1315 BUGTRAQ:20041112 phpBB Code EXEC (v2.0.10)  View
66121 9743 CVE-2004-1315 URL:http://marc.info/?l=bugtraq&m=110029415208724&w=2  View
66122 9743 CVE-2004-1315 BUGTRAQ:20041118 EXEC exploit in phpBB - fix  View
66123 9743 CVE-2004-1315 URL:http://marc.info/?t=110079440800004&r=1&w=2  View
66124 9743 CVE-2004-1315 BUGTRAQ:20041220 phpBB Worm  View
66125 9743 CVE-2004-1315 URL:http://marc.info/?l=bugtraq&m=110365752909029&w=2  View
66126 9743 CVE-2004-1315 BUGTRAQ:20041222 Re: phpBB Worm  View
66127 9743 CVE-2004-1315 URL:http://www.securityfocus.com/archive/1/385208  View
66128 9743 CVE-2004-1315 CONFIRM:http://www.phpbb.com/phpBB/viewtopic.php?t=240513  View
66129 9743 CVE-2004-1315 GENTOO:GLSA-200411-32  View
66130 9743 CVE-2004-1315 URL:https://security.gentoo.org/glsa/200411-32  View
66131 9743 CVE-2004-1315 CERT:TA04-356A  View
66132 9743 CVE-2004-1315 URL:http://www.us-cert.gov/cas/techalerts/TA04-356A.html  View
66133 9743 CVE-2004-1315 CERT-VN:VU#497400  View
66134 9743 CVE-2004-1315 URL:http://www.kb.cert.org/vuls/id/497400  View
66135 9743 CVE-2004-1315 BID:10701  View
66136 9743 CVE-2004-1315 URL:http://www.securityfocus.com/bid/10701  View
66137 9743 CVE-2004-1315 SECUNIA:13239  View
66138 9743 CVE-2004-1315 URL:http://secunia.com/advisories/13239/  View
66139 9743 CVE-2004-1315 XF:phpbb-view-sql-injection(18052)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
63104 JVNDB-2004-000446 Mozilla の MSG_UnEscapeSearchUrl() 関数におけるバッファオーバーフローの脆弱性 Mozilla には、NNTP の実装に使用されている nsNNTPProtocol.cpp の MSG_UnEscapeSearchUrl() 関数において、NULL 終端文字の処理に不備が存在するため、バッファオーバーフローが発生する脆弱性が存在します。 CVE-2004-1316 9743 5 http://jvndb.jvn.jp/ja/contents/2004/JVNDB-2004-000446.html  View