Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
phpBB 2.0.11, and possibly other versions, with remote avatars and avatar uploading enabled, allows local users to read arbitrary files by providing both a local and remote location for an avatar, then modifying the "Upload Avatar from a URL:" field to reference the target file.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
phpBB Group phpBB2 任意文件泄露漏洞
Vulnerability Description
phpBB Group phpBB2是一款开放源代码PHP论坛程序。 phpBB2对用户提交的URL输入缺少充分过滤，远程攻击者可以利用这个漏洞以WEB权限查看系统任意文件。 当用户请求上传一个avatar时，变量'$user_avatar_upload'默认从远程URL上传，'$avatar_mode'变量默认从本地电脑上传。变量'$user_avatar_upload'是否包含远程URL或临时服务器名依据要上传源avatar是本地或远程。如果本地和远程上传同时请求，临时上传位置就被远程服务器名代替，这
CVSS Information
N/A
Vulnerability Type
N/A