CVE-2006-2865: High severity Phpbb Group Phpbb vulnerability
DISPUTED PHP remote file inclusion vulnerability in template.php in phpBB 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: followup posts have disputed this issue, stating that template.php does not appear in phpBB and does not use a $page variable. It is possible that this is a site-specific vulnerability, or an issue in a mod.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2865?
CVE-2006-2865 is considered a remote file inclusion vulnerability which could potentially allow attackers to execute arbitrary PHP code.
How do I fix CVE-2006-2865?
To mitigate CVE-2006-2865, it is recommended to upgrade your phpBB installation to a patched version that does not include the vulnerable template.php file.
Which versions of phpBB are affected by CVE-2006-2865?
CVE-2006-2865 affects phpBB versions 2.0.1 through 2.0.20, including specific versions like 2.0.5, 2.0.7a, and others.
Can CVE-2006-2865 lead to a complete server compromise?
Yes, if exploited, CVE-2006-2865 could lead to a complete server compromise due to the execution of arbitrary PHP code.
Is there a way to detect if CVE-2006-2865 has been exploited?
Detection of CVE-2006-2865 exploitation may involve reviewing web server logs for unusual requests or behavior related to the phpBB application.