FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-4758

This CVE name corresponds to:

Entered	Topic
2006-10-04	phpbb -- NULL byte injection vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-4758 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-4758
Phase	Assigned(20060913)

Description

phpBB 2.0.21 does not properly handle pathnames ending in %00, which allows remote authenticated administrative users to upload arbitrary files, as demonstrated by a query to admin/admin_board.php with an avatar_path parameter ending in .php%00.

References

Source	Reference
BUGTRAQ	20060911 ShAnKaR: multiple PHP application poison NULL byte vulnerability
MISC	http://www.security.nnov.ru/Odocument221.html
MISC	http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=489624
CONFIRM	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=388120
DEBIAN	DSA-1488
BID	20347
BID	21806
SECUNIA	22188
SECUNIA	28871
XF	phpbb-nullbyte-file-upload(28884)