Secunia

Some vulnerabilities have been reported in phpBB2 Plus, which can be exploited by malicious people to disclose sensitive information or to compromise a vulnerable system.

1) Input passed to the "phpbb_root_path" parameter in language/lang_german/lang_main_album.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources.

2) Input passed to the "phpbb_root_path" parameter in language/lang_german/lang_admin_album.php, language/lang_english/lang_main_album.php, and language/lang_english/lang_admin_album.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources.

Successful exploitation of all vulnerabilities requires that "register_globals" is enabled.

The vulnerabilities are reported in versions 1.53a downloaded before 2007-09-22 and 1.53. Other versions may also be affected.

Solution
Update to version 1.53a released on 2007-09-22.

Provided and/or discovered by
1) Mehrad Ansari Targhi
2) Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
1) http://milw0rm.com/exploits/4434
2) http://www.phpbb2.de/ftopic45218.html

Deep Links
Links available in Customer Area