CVE-2004-1404 Attachment Mod 2.3.10 module for phpBB, when used with Apache mod_mime, does not properly handle files with multiple file extensions, such as .php.rar, which allows remote attackers to upload and exec...
HighCVSS 7.5
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Attachment Mod 2.3.10 module for phpBB, when used with Apache mod_mime, does not properly handle files with multiple file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opentools attachment mod | = 2.3.4 | No fix listed |
| opentools attachment mod | = 2.3.5 | No fix listed |
| opentools attachment mod | = 2.3.6 | No fix listed |
| opentools attachment mod | = 2.3.7 | No fix listed |
| opentools attachment mod | = 2.3.8 | No fix listed |
| opentools attachment mod | = 2.3.9 | No fix listed |
| opentools attachment mod | = 2.3.10 | No fix listed |
References
- 20041216 STG Security Advisory: [SSA-20041215-18] Vulnerability of uploading files with multiple extensions in phpBB Attachment Mod mailing-list
- 13421 patch third-party-advisory
- www.opentools.de patch
- 11893 patch vdb-entry
- attachment-mod-file-upload(18438) vdb-entry