CVE-2005-3799
Description
phpBB 2.0.18 allows remote attackers to obtain sensitive information via a large SQL query, which generates an error message that reveals SQL syntax or the full installation path.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
Root cause
"Missing input-length validation in search.php allows oversized SQL queries, causing verbose error messages that leak SQL syntax and the full installation path."
Attack vector
An attacker sends a crafted HTTP POST request to `search.php` with an extremely large value in the `search_keywords` parameter (e.g., 1 MB of data). Because phpBB does not validate input length, the oversized query is forwarded to the database, which rejects it when the packet exceeds MySQL's `max_allowed_packet` setting. The resulting error message discloses the SQL query structure and the server's file path [ref_id=1]. Alternatively, if PHP's `memory_limit` or `max_execution_time` is exceeded, the fatal error also reveals the installation path [ref_id=1][ref_id=2].
Affected code
The vulnerability lies in `search.php` and `includes/functions_search.php` of phpBB 2.0.18. The application does not limit the size of user-supplied input (e.g., the `search_keywords` POST variable), allowing an oversized SQL query to be sent to the database server. This triggers verbose error messages that reveal SQL syntax or the full filesystem installation path.
What the fix does
The advisory does not include a patch. The recommended remediation is to implement input-length validation on all user-supplied variables before they are used in SQL queries, so that oversized payloads are rejected before reaching the database or exhausting PHP resources [ref_id=1][ref_id=2]. Without such limits, the application remains dependent on PHP environment settings (e.g., `memory_limit`, `max_execution_time`) to prevent information disclosure.
Preconditions
- configThe server must have `display_errors` enabled (or error reporting configured to show debug messages).
- networkThe attacker must be able to send HTTP POST requests to the phpBB `search.php` endpoint.
- configThe MySQL `max_allowed_packet` must be smaller than the attacker's payload, or PHP's `memory_limit`/`max_execution_time` must be low enough to be exhausted by the oversized input.
Generated on Jun 17, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- securityreason.com/achievement_exploitalert/4nvdExploit
- marc.infonvd
- marc.infonvd
News mentions
0No linked articles in our index yet.