CVE-2002-1537

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

admin_ug_auth.php in phpBB 2.0.0 allows local users to gain administrator privileges by directly calling admin_ug_auth.php with modifed form fields such as "u".

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2002-10/0385.htmlExploit, Vendor Advisory
http://www.iss.net/security_center/static/10489.phpPatch, Vendor Advisory
http://www.osvdb.org/4284
http://www.securityfocus.com/bid/6056Patch, Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2002-10/0385.htmlExploit, Vendor Advisory
http://www.iss.net/security_center/static/10489.phpPatch, Vendor Advisory
http://www.osvdb.org/4284
http://www.securityfocus.com/bid/6056Patch, Vendor Advisory

Timeline

Published: Mar 31, 2003
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-15385.0Acuma Acusend 4, and possibly earlier versions, allows remote authenticated users to read the reports of other users by inferring the full U CVE-2002-15395.0Buffer overflow in MDaemon POP server 6.0.7 and earlier allows remote authenticated users to cause a denial of service via long (1) DELE or CVE-2002-15407.2The client for Symantec Norton AntiVirus Corporate Edition 7.5.x before 7.5.1 Build 62 and 7.6.x before 7.6.1 Build 35a runs winhlp32 with r CVE-2002-15417.5BadBlue 1.7 allows remote attackers to bypass password protections for directories and files via an HTTP request containing an extra / (slas CVE-2002-15425.0SolarWinds TFTP server 5.0.55 and earlier allows remote attackers to cause a denial of service (crash) via a large UDP datagram, possibly tr CVE-2002-15434.6Buffer overflow in trek on NetBSD 1.5 through 1.5.3 allows local users to gain privileges via long keyboard input.CVE-2002-15446.4Directory traversal vulnerability in CooolSoft Personal FTP Server 2.24 allows remote attackers to read or modify arbitrary files via .. (do CVE-2002-15455.0CooolSoft Personal FTP Server 2.24 allows remote attackers to obtain the absolute pathname of the FTP root via a PWD command, which includes CVE-2002-15467.5BRS WebWeaver Web Server 1.01 allows remote attackers to bypass password protections for files and directories via an HTTP request containin CVE-2002-15475.0Netscreen running ScreenOS 4.0.0r6 and earlier allows remote attackers to cause a denial of service via a malformed SSH packet to the Secure CVE-2002-15487.2Unknown vulnerability in autofs on AIX 4.3.0, when using executable maps, allows attackers to execute arbitrary commands as root, possibly r CVE-2002-15497.5Buffer overflow in Light HTTPd (lhttpd) 0.1 allows remote attackers to execute arbitrary code via a long HTTP GET request.