Description

phpBB 2.0.20 does not properly verify user-specified input variables used as limits to SQL queries, which allows remote attackers to obtain sensitive information via a negative LIMIT specification, as demonstrated by the start parameter to memberlist.php, which reveals the SQL query in the resulting error message.

Remediation

References

CVE-2006-2220

Related Vulnerabilities

Drupal Core 8.8.0 Denial of Service (8.8.0)

MySQL CVE-2020-14568 Vulnerability (CVE-2020-14568)

WordPress 4.7.x Multiple Vulnerabilities (4.7 - 4.7.13)

Drupal Missing Authorization Vulnerability (CVE-2017-6923)

Apache Tomcat Improper Input Validation Vulnerability (CVE-2014-0095)

Severity

Medium

Classification

CVE-2006-2220 CWE-20

Tags

Missing Update Known Vulnerabilities