Vulnerability record · CVE-2004-1315 · published 12 November 2004
CVE-2004-1315: phpBB viewtopic.php highlight parameter code execution
Phpbb Group · Phpbb
phpBB 2.x before 2.0.11 improperly URL-decodes the highlight parameter in viewtopic.php when extracting words to highlight, so double-encoded input places special characters into a result that is later processed by PHP exec. This lets a remote attacker run arbitrary PHP code on the server. It matters because the flaw is trivially reachable over the web and was weaponized at scale by the Santy.A worm.
Description
viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
critical priorityUnauthenticated remote code execution in a widely deployed forum product with confirmed worm exploitation and very high EPSS.
What it is
phpBB 2.x before 2.0.11 improperly URL-decodes the highlight parameter in viewtopic.php when extracting words to highlight, so double-encoded input places special characters into a result that is later processed by PHP exec. This lets a remote attacker run arbitrary PHP code on the server. It matters because the flaw is trivially reachable over the web and was weaponized at scale by the Santy.A worm.
Impact
An unauthenticated remote attacker gains arbitrary PHP code execution in the web server's context, enabling full compromise of the forum host and any data or credentials it can reach.
Attack surface
Reached over the network via HTTP requests to viewtopic.php with a crafted highlight parameter; the CVSS vector AV:N/AC:L/Au:N confirms no authentication and no user interaction are required.
Exploitation
CISA KEV does not list it, but EPSS is very high (0.72, 99.4th percentile) and the description states it was exploited by the Santy.A worm, indicating real-world exploitation.
What to do
- Upgrade phpBB to 2.0.11 or later, which fixes the highlight parameter handling.
- If immediate upgrade is impossible, apply the vendor patch referenced in the phpBB advisory and CERT/US-CERT alerts.
- Restrict or block external access to vulnerable phpBB installations until patched.
- Review web server and PHP logs for double-encoded highlight parameters and unexpected exec activity.
Detection
- Search HTTP access logs for viewtopic.php requests with highlight parameters containing double-encoded sequences such as %25.
- Monitor for Santy.A worm indicators, including requests to viewtopic.php with highlight set to a URL-encoded payload.
- Alert on PHP process spawning shell commands or writing unexpected files from the web root.
- Check for modified or newly created PHP files in the phpBB directory.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-1315 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-1315), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
