Critical vulnerability found in phpBB software

01 Mar 2005

minute read

Authors

Roel Schouwenberg

phpBB.com have announced that their phpBB software contains a critical vulnerability.
This news comes just days after the release of 2.0.12, which was released to adress certain other vulnerabilities.

Exploitation of this vulnerability gives administrative rights, meaning arbitrary code can be executed.

This could mean that we see a Santy-like scenario all over again, with a lot of servers being affected.
Although I believe we would see only a few defaced websites in this case, instead I’m expecting a lot of zombies.

phpBB.com have released version 2.0.13 which is no longer vulnerable for this vulnerability.

You are severely urged to update to the latest version as soon as possible.

Authors

Roel Schouwenberg

Critical vulnerability found in phpBB software

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Latest Posts

Latest Webinars

Reports

Kaspersky GReAT experts dive deep into the BlueNoroff APT’s GhostCall and GhostHire campaigns. Extensive research detailing multiple malware chains targeting macOS, including a stealer suite, fake Zoom and Microsoft Teams clients and ChatGPT-enhanced images.

Kaspersky researchers discovered previously unidentified commercial Dante spyware developed by Memento Labs (formerly Hacking Team) and linked it to the ForumTroll APT attacks.

Kaspersky GReAT experts describe the latest Mysterious Elephant APT activity. The threat actor exfiltrates data related to WhatsApp and employs tools such as BabShell and MemLoader HidenDesk.

According to Kaspersky, Librarian Ghouls APT continues its series of attacks on Russian entities. A detailed analysis of a malicious campaign utilizing RAR archives and BAT scripts.

Critical vulnerability found in phpBB software

GReAT Ideas. Balalaika Edition

GReAT Ideas. Green Tea Edition

GReAT Ideas. Powered by SAS: malware attribution and next-gen IoT honeypots

GReAT Ideas. Powered by SAS: threat actors advance on new fronts

GReAT Ideas. Powered by SAS: threat hunting and new techniques

ZeroLocker won’t come to your rescue

A Post-PC BlackHat?

Adobe Updates April 2014

Trust. Trust. Trust

Adobe’s First Patch Tuesday of 2014

Deep analysis of the flaw in BetterBank reward logic

Post-exploitation framework now also delivered via npm

Massive npm infection: the Shai-Hulud worm and patient zero

The SOC files: Rumble in the jungle or APT41’s new target in Africa

Russian organizations targeted by backdoor masquerading as secure networking software updates

Latest Posts

The evolving landscape of email phishing attacks: how threat actors are reusing and refining established techniques

PassiveNeuron: a sophisticated campaign targeting servers of high-profile organizations

Post-exploitation framework now also delivered via npm

SEO spam and hidden links: how to protect your website and your reputation

Latest Webinars

Fortify your mobile protection: Building customer trust with advanced security

Unmasking email dangers: Detecting and defending against mail threats

Kaspersky Scan Engine: Built to integrate, engineered to protect

Kaspersky’s way of cloud workload protection

Reports

Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs

Mem3nt0 mori – The Hacking Team is back!

Mysterious Elephant: a growing threat

Sleep with one eye open: how Librarian Ghouls steal data by night

Subscribe to our weekly e-mails