phpBB 2.0.x Remote Unspecified "bbcode.php" Vulnerability

[AlphaWolf]

 FrSIRT Advisory : FrSIRT/ADV-2005-0498
CVE Reference : GENERIC-MAP-NOMATCH
Rated as : High Risk
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-05-09

 * Technical Description *

phpBB Group has released a security patch to correct a vulnerability identified in phpBB. The flaw is due to an unspecified error in the "bbcode.php" script, which may be exploited by attackers to bypass certain security restrictions and potentially execute arbitrary commands on a vulnerable system.

 * Affected Products *

phpBB Group phpBB version 2.0.14 and prior

 * Solution *

Upgrade to phpBB version 2.0.15 :
http://www.phpbb.com/downloads.php

 * References *

http://www.frsirt.com/english/advisories/2005/0498
http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=288194