CVE-2008-1171
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedMultiple PHP remote file inclusion vulnerabilities in the 123 Flash Chat Module for phpBB allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) 123flashchat.php and (2) phpbb_login_chat.php. NOTE: CVE disputes this issue because $phpbb_root_path is explicitly set to "./" in both programs
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceMultiple PHP remote file inclusion vulnerabilities were reported in the 123 Flash Chat Module for phpBB, allowing remote code execution via the phpbb_root_path parameter in 123flashchat.php and phpbb_login_chat.php. However, the CVE entry notes dispute because $phpbb_root_path is explicitly hardcoded to './' in both files, which would prevent external path injection.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE dataall versionsCVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- M
- Authentication
- None
- Confidentiality
- Partial
- Integrity
- Partial
- Availability
- Partial
AV:N/AC:M/Au:N/C:P/I:P/A:P
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Locate the 123 Flash Chat module filesSearch for 123flashchat.php and phpbb_login_chat.php in your phpBB installation directory, typically under modules/ or a dedicated 123flashchat/ folder.Affected if The files exist in the phpBB installation.
-
Inspect the $phpbb_root_path variable in 123flashchat.phpOpen 123flashchat.php and search for the line defining or assigning $phpbb_root_path. Check if it is hardcoded to './' or if it uses an unvalidated request parameter.Affected if $phpbb_root_path is assigned directly from $_GET, $_POST, or $_REQUEST without validation, rather than being hardcoded to './'.
-
Inspect the $phpbb_root_path variable in phpbb_login_chat.phpOpen phpbb_login_chat.php and locate the $phpbb_root_path definition. Verify whether it is statically set to './' or accepts dynamic user input.Affected if $phpbb_root_path derives from external input without sanitization instead of being hardcoded to './'.
-
Check for included files using $phpbb_root_pathSearch for include, require, or include_once statements that concatenate $phpbb_root_path with a file path, for example: include($phpbb_root_path . 'common.php').Affected if The module uses $phpbb_root_path in include/require statements with user-controllable input.
You are affected only if $phpbb_root_path in either 123flashchat.php or phpbb_login_chat.php is not hardcoded to './' and can be controlled via URL parameters, allowing external file inclusion.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataVerify the hardcoded $phpbb_root_path value in the affected PHP files to confirm the dispute claim; if any dynamic path handling exists, enforce strict allowlist validation or remove the parameter entirely.
- Consultation2.0 h
- Implementation1.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,696.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2008-1171 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2008-1171 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data