CVE-2001-1471

HIGH

phpbb < 1.4.0 - Authenticated Remote Code Execution via Invalid Language Value

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2001-1471. PoCs published by UnderSpell.

AI-analyzed exploit summary This exploit targets an input validation error in phpBB's 'page_header.php' script, allowing arbitrary command execution via the eval() function. It sends crafted HTTP requests to exploit the vulnerability and execute commands on the target system.

Description

prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.

Exploits (1)

exploitdb WORKING POC VERIFIED
by UnderSpell · perlwebappsphp
https://www.exploit-db.com/exploits/21065

This exploit targets an input validation error in phpBB's 'page_header.php' script, allowing arbitrary command execution via the eval() function. It sends crafted HTTP requests to exploit the vulnerability and execute commands on the target system.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: phpBB 2.x
Auth required
Prerequisites: Registered user credentials · Access to the phpBB installation path
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Broken Link mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2001-08/0123.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/6944
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/920931
Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/3167

Scores

CVSS v3 8.8
EPSS 0.0770
EPSS Percentile 93.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-665
Status published
Products (1)
phpbb/phpbb < 1.4.0
Published Jul 31, 2001
Tracked Since Feb 18, 2026