| Package | Affected versions | Patched versions |
|---|---|---|
| phpbb | = 2.0.0= 2.0.1= 2.0.10= 2.0.11= 2.0.12= 2.0.13= 2.0.14= 2.0.2= 2.0.3= 2.0.4= 2.0.5= 2.0.6= 2.0.6c= 2.0.6d= 2.0.7= 2.0.7a= 2.0.8= 2.0.8a= 2.0.9= 2.0_beta1= 2.0_rc1= 2.0_rc2= 2.0_rc3= 2.0_rc4 |
The bbencode_second_pass and make_clickable functions in bbcode.php for phpBB before 2.0.15, as used in viewtopic.php, privmsg.php, and other scripts, allow remote attackers to execute arbitrary script via a BBcode tag with a (1) javascript:, (2) applet:, (3) about:, (4) activex:, (5) chrome:, or (6) script: URI scheme, as demonstrated using the URL tag.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free