CVE-2004-1809

Vulnerability

A cross-site scripting (XSS) vulnerability exists in phpBB versions 2.0.6d and earlier. The postdays parameter in viewtopic.php and the topicdays parameter in viewforum.php are not properly sanitized before being reflected in output. An attacker can inject arbitrary HTML or JavaScript by crafting a URL with a malicious payload in these parameters. The vulnerability is triggered when the query returns results, requiring valid forum or topic IDs and appropriate day values. [2]

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by crafting a malicious URL containing the XSS payload in either the postdays or topicdays parameter. The attacker must convince a victim to click the link (e.g., via email or social engineering). No special network position or authentication is required. Example URLs: viewforum.php?f=1&topicdays=1">&start=0 or viewtopic.php?t=10&postdays=1">&start=0. [2]

Impact

Successful exploitation allows the attacker to execute arbitrary HTML or JavaScript in the victim's browser within the context of the vulnerable phpBB application. This can lead to cookie theft, session hijacking, site defacement, or redirection to malicious sites. The attacker does not gain elevated privileges on the server but can impersonate the victim user. [1][2]

Mitigation

The vendor released a fix in subsequent versions (e.g., phpBB 2.0.7 or later). Users should upgrade to a patched version. As a workaround, administrators can sanitize the postdays and topicdays parameters manually, for example by stripping HTML tags or encoding special characters. This CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. [1]