Description

The search function in phpBB 2.x provides a search_id value that leaks the state of PHP's PRNG, which allows remote attackers to obtain potentially sensitive information, as demonstrated by a cross-application attack against WordPress, a different vulnerability than CVE-2006-0632.

Remediation

References

CVE-2008-4125

Related Vulnerabilities

WordPress Pingback Source URI Denial of Service and Information Disclosure Vulnerabilities (0.6.2 - 2.1.3)

PHP Cryptographic Issues Vulnerability (CVE-2011-2483)

Apache HTTP Server Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2009-0023)

WordPress Plugin tcS3 Cross-Site Scripting (2.1.1)

Sqlite Uncontrolled Recursion Vulnerability (CVE-2019-19645)

Severity

Medium

Classification

CVE-2008-4125

Tags

Missing Update Known Vulnerabilities