CVE-2004-0339

## Vulnerability phpBB versions possibly 2.0.6c and earlier contain a cross-site scripting (XSS) vulnerability in ViewTopic.php. The postorder parameter is not properly sanitized, allowing injection of arbitrary HTML or script into the generated page. The vulnerable code path is reachable whenever a topic is viewed with any value for postorder [1].

Exploitation

An attacker can inject malicious code by crafting a URL containing a postorder parameter with script payloads, such as %22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C (unescaping to "><script>alert(document.cookie)</script><) [1]. When a victim clicks the crafted link, the injected script executes in the context of the phpBB site. No authentication or special privileges are required; the attacker only needs to lure the victim to the malicious URL.

Impact

Successful exploitation allows remote attackers to execute arbitrary HTML or script in the context of the victim's browser, potentially leading to session cookie theft or other client-side attacks. The attacker can impersonate the victim, read sensitive information displayed on the forum, or perform actions on behalf of the user [1]. The compromise occurs entirely in the browser and can affect any user who visits the malicious link.

Mitigation

The official fix for CVE-2004-0339 was included in phpBB 2.0.7, released in March 2004. The vulnerability is addressed by properly sanitizing the postorder parameter. Users should upgrade to phpBB 2.0.7 or later [1]. If upgrading is not possible, applying a manual patch to validate the postorder parameter against a whitelist of allowed values (e.g., "asc", "desc") is a workaround.