CVE-2006-0632

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-02-10 · updated 2026-06-16

Description

The gen_rand_string function in phpBB 2.0.19 uses insufficiently random data (small value space) to create the activation key ("validation ID") that is sent by e-mail when establishing a password, which makes it easier for remote attackers to obtain the key and modify passwords for existing accounts or create new accounts.

Affected products

Phpbb Group Phpbb: 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5 (+23)

References

http://secunia.com/advisories/18727
http://www.osvdb.org/22949
http://www.r-security.net/tutorials/view/readtutorial.php?id=4
http://www.securityfocus.com/archive/1/424074/100/0/threaded
http://www.vupen.com/english/advisories/2006/0461
https://exchange.xforce.ibmcloud.com/vulnerabilities/24573
http://secunia.com/advisories/18727
http://www.osvdb.org/22949
http://www.r-security.net/tutorials/view/readtutorial.php?id=4
http://www.securityfocus.com/archive/1/424074/100/0/threaded
http://www.vupen.com/english/advisories/2006/0461
https://exchange.xforce.ibmcloud.com/vulnerabilities/24573

Get alerted when CVE-2006-0632 or the next vulnerability affects your stack