CVE-2001-1471 Code injection in n/a
Authenticated users can execute arbitrary PHP code in phpBB by manipulating uninitialized variables via an invalid language value.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2001-1471?
CVE-2001-1471 is a high-severity code injection vulnerability in n/a, published on 21 Apr 2005. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.
Weakness: CWE-665
Which versions are affected by CVE-2001-1471?
It affects 1 product.
Products include Phpbb Phpbb.
How do I fix CVE-2001-1471?
No fix has been published for CVE-2001-1471 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2001-1471 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2001-1471 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
- CVE-2008-3224 Other in n/a
- CVE-2008-1766 Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bu
- CVE-2025-70810 Cross-site request forgery in n/a
- CVE-2026-29199 phpBB has Password Reset Link Poisoning via Host Header injection
- CVE-2019-16108 phpBB arbitrary CSS injection
Sources
Also known as GHSA-xxf9-rgcc-942c.