CVE:CVE-2006-5526
CNNVD:CNNVD-200610-445
当Teake Nutma Foing在Fully Modded phpBB (phpbbfm) 2021.4.40和更早的版本中修改时存在多个PHP远程文件包含漏洞，远程攻击者可以通过player/目录下(a)faq.php，(b)index.php，(c)list.php，(d)login.php，(e)playlist.php，(f)song.php，(g)gen_m3u.php，(h)view_artist.php，(i)view_song.php，(j)flash/set_na.php，(k)flash/initialise.php，(l)flash/get_song.php，(m)includes/common.php，(n)admin/nav.php，(o)admin/main.php，(p)admin/list_artists.php，(q)admin/index.php，(r)admin/genres.php，(s)admin/edit_artist.php，(t)admin/edit_album.php，(u)admin/config.php和(v)admin/admin_status.php的foing_root_path参数包含的URL来执行任意PHP代码。
solution:Upgrade fully_modded_phpbb fully_modded_phpbb to a higher version than 2021.4.40,and avoid the version (,2021.4.40]