CVE-2006-1896 Code injection in n/a
Authenticated administrators can execute arbitrary PHP code via crafted font color or signature values in phpBB.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-1896?
CVE-2006-1896 is a medium-severity code injection vulnerability in Phpbb Group Phpbb, published on 20 Apr 2006. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Unspecified vulnerability in phpBB allows remote authenticated users with Administration Panel access to execute arbitrary PHP code via crafted Font Colour 3 ($theme[fontcolor3] variable) and/or signature values, possibly involving the highlight functionality. NOTE: the original report does not clarify whether this issue is static code injection, eval injection, or another type of vulnerability.
Weakness: CWE-94
Which versions are affected by CVE-2006-1896?
It affects 1 product.
Products include Phpbb Group Phpbb.
How do I fix CVE-2006-1896?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2006-1896 being exploited?
There is no known exploitation of CVE-2006-1896 in the wild and no public exploit code.
Other vulnerabilities in Phpbb Group Phpbb
Sources
Also known as DSA-1066-1, GHSA-hmj9-32vf-6qxp.