phpBB: Cross-Site Scripting Vulnerability

phpBB: Cross-Site Scripting Vulnerability phpBB is vulnerable to a cross-site scripting attack that could allow arbitrary scripting code execution. phpBB May 14, 2005 May 14, 2005: 01 90213 remote 2.0.15 2.0.15

phpBB is an Open Source bulletin board package.

phpBB is vulnerable to a cross-site scripting vulnerability due to improper sanitization of user supplied input. Coupled with poor validation of BBCode URLs which may be included in a forum post, an unsuspecting user may follow a posted link triggering the vulnerability.

Successful exploitation of the vulnerability could cause arbitrary scripting code to be executed in the browser of a user.

There are no known workarounds at this time.

All phpBB users should upgrade to the latest version:


    emerge --sync
    emerge --ask --oneshot --verbose ">=www-apps/phpBB-2.0.15"

BugTraq ID 13344 SecurityTracker ID 1013918 koon koon r2d2