Home  >  CVE-2001-1471
CVE Details for CVE: CVE-2001-1471
Summary
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.
Timestamps
Last major update 11-07-2017 - 01:29
Published 31-07-2001 - 04:00
Last modified 11-07-2017 - 01:29
References
Vulnerable Configurations
  • cpe:2.3:a:phpbb_group:phpbb:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:1.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:1.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.2.0:*:*:*:*:*:*:*
CAPEC
Click the CAPEC title to display a description
CWE
NVD-CWE-Other
CVSS
Base
4.6
Impact
6.4
Exploitability
3.9
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
CVSS3
None
VIA4 references
cvss-vector via4
AV:L/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 3167
bugtraq
  • 20010804 Re: phpBB 1.4.0 bug leads to easy admin privileges
  • 20010810 Easily and Remotely Pipe a Covert Shell on phpBB version 1.4.0 and below
cert-vn VU#920931
xf phpbb-admin-access(6944)