Remote File Inclusion Vulnerability in phpBB by phpBB Group

CVE-2006-5435

What is CVE-2006-5435?

phpBB versions 2.0.10 and earlier are vulnerable to a remote file inclusion attack through the groupcp.php script. Attackers can exploit this vulnerability to execute arbitrary PHP code by injecting a malicious URL into the phpbb_root_path parameter, though it is worth noting that the vendor argues this parameter's definition precedes its usage. This flaw poses a significant risk if not addressed promptly.

References