CVE-2007-1695 File upload in n/a

Critical 10.0 Published 27 Mar 2007 Updated 7 Aug 2024

Remote attackers can execute arbitrary PHP code via a URL in the phpbb_root_path parameter, though the vulnerability is disputed.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2007-1695?

CVE-2007-1695 is a critical vulnerability in Phpbb Group Phpbb, published on 27 Mar 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

PHP remote file inclusion vulnerability in includes/usercp_register.php in phpBB 2.0.19 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE: this issue has been disputed by third-party researchers, stating that the file checks for a global constant and cannot be accessed directly

Which versions are affected by CVE-2007-1695?

It affects 1 product.

Products include Phpbb Group Phpbb.

How do I fix CVE-2007-1695?

No fix has been published for CVE-2007-1695 yet. Limit exposure of the affected software until one is available.

Is CVE-2007-1695 being exploited?

There is no known exploitation of CVE-2007-1695 in the wild and no public exploit code.

All Phpbb Group Phpbb vulnerabilities

Sources

Also known as GHSA-gvxx-r4qp-c95v.