CVE-2019-25685 - Vulnerability Analysis

Overview

phpBB contains an unrestricted file upload vulnerability caused by exploitation of plupload and phar:// stream wrapper in attachment settings, letting authenticated attackers execute arbitrary code via crafted zip files.

Severity & Score

Impact

Authenticated attackers can upload malicious files leading to remote code execution and full system compromise.

Mitigation

Update to the latest phpBB version with the vulnerability fixed.

References

• https://www.exploit-db.com/exploits/46512
• https://www.vulncheck.com/advisories/phpbb-arbitrary-file-upload-via-phar-deserialization

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner