CVE-2008-1171: Code Injection

Published Mar 5, 2008

Updated

DISPUTED Multiple PHP remote file inclusion vulnerabilities in the 123 Flash Chat Module for phpBB allow remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter to (1) 123flashchat.php and (2) phpbbloginchat.php. NOTE: CVE disputes this issue because $phpbbrootpath is explicitly set to "./" in both programs.

Affected Software

1 affected component

phpBB 123 Flash Chat Module

Event History

Mar 5, 2008

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Disputed

11:44 PM

Frequently Asked Questions

What is the severity of CVE-2008-1171?

CVE-2008-1171 is considered to have a significant severity as it allows remote code execution through PHP file inclusion.

How do I fix CVE-2008-1171?

To fix CVE-2008-1171, you should update to the latest version of the 123 Flash Chat Module for phpBB that addresses these vulnerabilities.

What software is affected by CVE-2008-1171?

CVE-2008-1171 affects the 123 Flash Chat Module for phpBB.

Can CVE-2008-1171 allow attackers to execute arbitrary code?

Yes, CVE-2008-1171 allows remote attackers to execute arbitrary PHP code via remote file inclusion.

What are the entry points for exploitation in CVE-2008-1171?

The entry points for exploitation in CVE-2008-1171 are the phpbb_root_path parameter in 123flashchat.php and phpbb_login_chat.php.