GHSA-h3mr-q96r-37v4HighCVSS 7.2

phpBB Remote Code Execution

Published
May 13, 2022
Last Modified
April 24, 2024

🔗 CVE IDs covered (1)

CVE-2018-19274 →

📋 Description

Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.

🎯 Affected products1

  • composer/phpbb/phpbb:< 3.2.4

🔗 References (5)