CVE-2006-1896

phpBB - Authenticated PHP Code Execution via Font Colour 3 or Signature Values

Title source: llm

Description

Unspecified vulnerability in phpBB allows remote authenticated users with Administration Panel access to execute arbitrary PHP code via crafted Font Colour 3 ($theme[fontcolor3] variable) and/or signature values, possibly involving the highlight functionality. NOTE: the original report does not clarify whether this issue is static code injection, eval injection, or another type of vulnerability.

References (8)

Core 8

Core References

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/431015/100/0/threaded

Patch vendor-advisory x_refsource_debian

http://www.debian.org/security/2006/dsa-1066

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/25889

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/431387/100/0/threaded

Third Party Advisory third-party-advisory x_refsource_sreason

http://securityreason.com/securityalert/715

Third Party Advisory third-party-advisory x_refsource_sreason

http://securityreason.com/securityalert/762

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20093

Patch, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20197

Scores

EPSS 0.0128

EPSS Percentile 66.5%

Details

CWE

CWE-94

Status published

Products (1)

phpbb_group/phpbb

Published Apr 20, 2006

Tracked Since Feb 18, 2026