CVE-2005-0258 | Vulnerability Database | Aqua Security

Directory traversal vulnerability in (1) usercp_register.php and (2) usercp_avatar.php for phpBB 2.0.11, and possibly other versions, with gallery avatars enabled, allows remote attackers to delete (unlink) arbitrary files via /../ sequences in the avatarselect parameter.

Affected Software

Name	Vendor	Start Version	End Version
Phpbb	Phpbb_group	2.0.0 (including)	2.0.0 (including)
Phpbb	Phpbb_group	2.0.1 (including)	2.0.1 (including)
Phpbb	Phpbb_group	2.0.2 (including)	2.0.2 (including)
Phpbb	Phpbb_group	2.0.3 (including)	2.0.3 (including)
Phpbb	Phpbb_group	2.0.4 (including)	2.0.4 (including)
Phpbb	Phpbb_group	2.0.5 (including)	2.0.5 (including)
Phpbb	Phpbb_group	2.0.6 (including)	2.0.6 (including)
Phpbb	Phpbb_group	2.0.6c (including)	2.0.6c (including)
Phpbb	Phpbb_group	2.0.6d (including)	2.0.6d (including)
Phpbb	Phpbb_group	2.0.7 (including)	2.0.7 (including)
Phpbb	Phpbb_group	2.0.7a (including)	2.0.7a (including)
Phpbb	Phpbb_group	2.0.8 (including)	2.0.8 (including)
Phpbb	Phpbb_group	2.0.8a (including)	2.0.8a (including)
Phpbb	Phpbb_group	2.0.9 (including)	2.0.9 (including)
Phpbb	Phpbb_group	2.0.10 (including)	2.0.10 (including)
Phpbb	Phpbb_group	2.0.11 (including)	2.0.11 (including)
Phpbb	Phpbb_group	2.0_beta1 (including)	2.0_beta1 (including)
Phpbb	Phpbb_group	2.0_rc1 (including)	2.0_rc1 (including)
Phpbb	Phpbb_group	2.0_rc2 (including)	2.0_rc2 (including)
Phpbb	Phpbb_group	2.0_rc3 (including)	2.0_rc3 (including)
Phpbb	Phpbb_group	2.0_rc4 (including)	2.0_rc4 (including)

References

http://www.gentoo.org/security/en/glsa/glsa-200503-02.xml
http://www.idefense.com/application/poi/display?id=205\u0026type=vulnerabilities
http://www.phpbb.com/support/documents.php?mode=changelog

NVD	https://nvd.nist.gov/vuln/detail/CVE-2005-0258
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html