Vulnerability Report

CVE-2004-1315

Title: phpBB highlight parameter PHP code execution

Other

Proof Of Concept

PoC Available for CVE-2004-1315

CWE Category NVD-CWE-noinfo
Published Date Nov 12, 2004
Modified Date Jun 16, 2026
Exploit Status Available
Score 7.5 CVSS v2.0
Exploit Probability (EPSS)
72.10%

Vulnerability Summary

CVE-2004-1315: viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.

Impacted Vendors

P
phpbb 1
P
phpbb_group 1

Reference Links

http://marc.info/?l=bugtraq&m=110029415208724&w=2 http://marc.info/?l=bugtraq&m=110365752909029&w=2 http://marc.info/?t=110079440800004&r=1&w=2 http://secunia.com/advisories/13239/ http://www.kb.cert.org/vuls/id/497400 http://www.phpbb.com/phpBB/viewtopic.php?t=240513 http://www.securityfocus.com/archive/1/385208 http://www.securityfocus.com/bid/10701 http://www.us-cert.gov/cas/techalerts/TA04-356A.html https://exchange.xforce.ibmcloud.com/vulnerabilities/18052 https://security.gentoo.org/glsa/200411-32 http://marc.info/?l=bugtraq&m=110029415208724&w=2 http://marc.info/?l=bugtraq&m=110365752909029&w=2 http://marc.info/?t=110079440800004&r=1&w=2 http://secunia.com/advisories/13239/ http://www.kb.cert.org/vuls/id/497400 http://www.phpbb.com/phpBB/viewtopic.php?t=240513 http://www.securityfocus.com/archive/1/385208 http://www.securityfocus.com/bid/10701 http://www.us-cert.gov/cas/techalerts/TA04-356A.html https://exchange.xforce.ibmcloud.com/vulnerabilities/18052 https://security.gentoo.org/glsa/200411-32
CVSS v2.0
Source Entity [email protected]
Severity HIGH
7.5
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2004-1315 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/12510
View Code
Exploit-DB https://www.exploit-db.com/exploits/16890
View Code
Exploit-DB https://www.exploit-db.com/exploits/647
View Code
Exploit-DB https://www.exploit-db.com/exploits/24274
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A
Complexity N/A
Privileges N/A
Interaction NONE
CVSS Vector String AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected Stack

No specific products linked.