Mustafa Can Bjorn has reported a vulnerability in the Activity Mod Plus module for phpBB, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "phpbb_root_path" parameter in "language/lang_english/lang_activity.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from external and local resources.

The "lang_activity_char.php" script is reportedly also affected.

Successful exploitation requires that "register_globals" is enabled.

Solution
Apply code changes as instructed by the vendor.
Further details available in Customer Area

Provided and/or discovered by
Mustafa Can Bjorn

Changelog
Further details available in Customer Area

Original Advisory
http://www.nukedx.com/?viewdoc=38

Deep Links
Links available in Customer Area