CVE:CVE-2007-5100
CNNVD:CNNVD-200709-380
phpBB Plus 1.53,和20070922之前1.53a存在多个PHP远程文件包含漏洞,当全局注册(register_globals)被激活时, 允许远程攻击者执借助(1) language/lang_german/lang_admin_album.php, (2) language/lang_english/lang_main_album.php,和(3) language/lang_english/lang_admin_album.php中的phpbb_root_path参数中的一个URL行任意PHP代码。
solution:Upgrade phpbb phpbb_plus to a higher version than 1.53a,1.53,and avoid the version (,1.53a],1.53