Home  >  CVE-2001-1472
CVE Details for CVE: CVE-2001-1472
Summary
SQL injection vulnerability in prefs.php in phpBB 1.4.0 and 1.4.1 allows remote authenticated users to execute arbitrary SQL commands and gain administrative access via the viewemail parameter.
Timestamps
Last major update 11-07-2017 - 01:29
Published 03-08-2001 - 04:00
Last modified 11-07-2017 - 01:29
References
Vulnerable Configurations
  • cpe:2.3:a:phpbb_group:phpbb:1.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:phpbb_group:phpbb:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:phpbb_group:phpbb:1.4.1:*:*:*:*:*:*:*
CAPEC
Click the CAPEC title to display a description
CWE
NVD-CWE-Other
CVSS
Base
4.6
Impact
6.4
Exploitability
3.9
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
CVSS3
None
VIA4 references
cvss-vector via4
AV:L/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 3142
bugtraq 20010803 phpBB 1.4.0 bug leads to easy admin privileges
cert-vn VU#314347
xf phpbb-admin-access(6944)