CVE-2006-1895: Code Injection
Direct static code injection vulnerability in includes/template.php in phpBB allows remote authenticated users with write access to execute arbitrary PHP code by modifying a template in a way that (1) bypasses a loose "." regular expression to match BEGIN and END statements in overallheader.tpl, or (2) is used in an eval statement by includes/bbcode.php for bbcode.tpl.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-1895?
CVE-2006-1895 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2006-1895?
To fix CVE-2006-1895, you should upgrade phpBB to a non-vulnerable version, preferably the latest available.
Who is affected by CVE-2006-1895?
CVE-2006-1895 affects phpBB version 2.0.9, where authenticated users with write access can exploit the vulnerability.
What type of vulnerability is CVE-2006-1895?
CVE-2006-1895 is a direct static code injection vulnerability that allows arbitrary PHP code execution.
What is the impact of CVE-2006-1895?
The impact of CVE-2006-1895 includes the ability for an attacker to execute arbitrary PHP code on the server.