CVE-2018-19274: phpBB Remote Code Execution
Summary
CVE-2018-19274: phpBB Remote Code Execution. Affects phpbb/phpbb versions < 3.2.4. Fixed in 3.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpBB is a popular open-source forum software written in PHP. It provides a platform for creating online communities and discussion boards. The vulnerability identified as CVE-2018-19274 affects phpBB versions prior to 3.2.4. This vulnerability allows for remote code execution through object injection when an attacker with founder permissions has access to the Admin Control Panel. The vulnerability arises from a file_exists check that can be bypassed by passing an absolute path. This can lead to the exploitation of Phar deserialization.
Vulnerability Detail
The vulnerability in phpBB allows an attacker with founder permissions to execute arbitrary code remotely. By exploiting the file_exists check, an attacker can inject malicious objects using Phar deserialization. This can result in the execution of arbitrary PHP code on the server, potentially leading to complete compromise of the affected system. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.2.
How To Fix
Minimum fixed version
3.2.4
This is the first release that contains the fix.
composer require phpbb/phpbb:3.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround can be implemented by modifying the affected code. The file_exists check should be replaced with a more secure method of verifying file existence, such as using the is_file function. Additionally, restricting access to the Admin Control Panel and limiting the permissions of users with founder privileges can help mitigate the risk of exploitation.
Conclusion
The vulnerability in phpBB (CVE-2018-19274) allows for remote code execution through object injection when an attacker with founder permissions has access to the Admin Control Panel. Upgrading to phpBB version 3.2.4 or later is the recommended solution to fix this vulnerability. Implementing the suggested workaround and following best practices for securing phpBB installations can help mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for phpbb/phpbb →
FAQ
phpBB is an open-source forum software written in PHP. It provides a platform for creating online communities and discussion boards.
Remote code execution refers to the ability of an attacker to execute arbitrary code on a target system remotely, without direct access to the server.
The vulnerability in phpBB arises from a file_exists check that can be bypassed by passing an absolute path. This allows an attacker with founder permissions to inject malicious objects using Phar deserialization, leading to the execution of arbitrary PHP code on the server.
The exploitation of this vulnerability can result in the complete compromise of the affected system. An attacker can execute arbitrary code, potentially gaining unauthorized access, stealing sensitive information, or causing damage to the system.
To protect your phpBB installation, it is recommended to upgrade to version 3.2.4 or later. Additionally, ensure that access to the Admin Control Panel is restricted and the permissions of users with founder privileges are limited.
Related vulnerabilities
Recent vulnerabilities recorded for phpbb/phpbb.
