CVE-2001-1472 SQL injection vulnerability in prefs.php in phpBB 1.4.0 and 1.4.1 allows remote authenticated users to execute arbitrary SQL commands and gain administrative access via the viewemail parameter.
MediumCVSS 4.6
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in prefs.php in phpBB 1.4.0 and 1.4.1 allows remote authenticated users to execute arbitrary SQL commands and gain administrative access via the viewemail parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpbb group phpbb | = 1.4.0 | No fix listed |
| phpbb group phpbb | = 1.4.1 | No fix listed |
References
- VU#314347 third-party-advisory us-government-resource
- 20010803 phpBB 1.4.0 bug leads to easy admin privileges exploit mailing-list
- 3142 exploit vdb-entry
- phpbb-admin-access(6944) vdb-entry