Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
phpBB2 highlight变量二次解码导致远程命令执行漏洞
Vulnerability Description
phpBB是一款由PHP编写的WEB论坛应用程序，支持多种数据库系统，可使用在多种Unix和Linux操作系统下。 phpBB对highlight变量不正确的二次解码导致远程攻击者可以注入PHP代码执行系统命令。 由于phpBB的URL解码会把%2527转换成%27(单引号)，并没有追加'\'号的，因此可以注入PHP代码执行系统命令。
CVSS Information
N/A
Vulnerability Type
N/A