CVE-2007-5100

phpBB Plus < 1.53a - Remote Code Execution via phpbb_root_path Parameter

Title source: llm

Description

Multiple PHP remote file inclusion vulnerabilities in phpBB Plus 1.53, and 1.53a before 20070922, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) language/lang_german/lang_admin_album.php, (2) language/lang_english/lang_main_album.php, and (3) language/lang_english/lang_admin_album.php, different vectors than CVE-2007-5009.

References (7)

Core 7

Core References

Patch x_refsource_confirm

http://www.phpbb2.de/ftopic45218.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26888

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/3247

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/38724

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/38723

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/38725

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/25776

Scores

EPSS 0.0249

EPSS Percentile 82.7%

Details

CWE

CWE-94

Status published

Products (2)

phpbb/phpbb_plus 1.53

phpbb/phpbb_plus < 1.53a

Published Sep 26, 2007

Tracked Since Feb 18, 2026