National Cyber Awareness System

Vulnerability Summary for CVE-2006-2735

Overview

PHP remote file inclusion vulnerability in language/lang_english/lang_activity.php in Activity MOD Plus (Amod) 1.1.0, as used with phpBB when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE: This is a similar vulnerability to CVE-2006-2507.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: SECUNIA

Name: 20354

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/20354

External Source: VUPEN

Name: ADV-2006-2045

Hyperlink:http://www.vupen.com/english/advisories/2006/2045

External Source: BUGTRAQ

Name: 20060529 RE: Advisory: Blend Portal <= 1.2.0 for phpBB 2.x(blend_data/blend_common.php) File Inclusion Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/435298/100/0/threaded

External Source: BUGTRAQ

Name: 20060528 Advisory: phpBB 2.x (Activity MOD Plus) File InclusionVulnerability.

Type: Advisory; Exploit

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/435286/100/0/threaded

External Source: MISC

Name: http://www.nukedx.com/?viewdoc=38

Type: Advisory; Exploit

Hyperlink:http://www.nukedx.com/?viewdoc=38

External Source: MISC

Name: http://www.nukedx.com/?getxpl=38

Hyperlink:http://www.nukedx.com/?getxpl=38

External Source: CONFIRM

Name: http://phpbb-tweaks.com/topics.html-p-17623#17623

Hyperlink:http://phpbb-tweaks.com/topics.html-p-17623#17623

External Source: XF

Name: activitymodplus-multiple-file-include(26857)

Hyperlink:http://xforce.iss.net/xforce/xfdb/26857

External Source: BID

Name: 18155

Hyperlink:http://www.securityfocus.com/bid/18155

External Source: OSVDB

Name: 25821

Hyperlink:http://www.osvdb.org/25821

External Source: SREASON

Name: 1001

Hyperlink:http://securityreason.com/securityalert/1001

External Source: FULLDISC

Name: 20060528 Advisory: phpBB 2.x (Activity MOD Plus) File Inclusion Vulnerability.

Hyperlink:http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0709.html