CVE-2004-1315

CVE-2004-1315 is a critical remote code execution vulnerability affecting phpBB 2.x versions prior to 2.0.11. This flaw arises from improper URL decoding of the 'highlight' parameter in viewtopic.php, allowing attackers to inject and execute arbitrary PHP code. With a CVSS score of 7.5, it presents a high risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. This vulnerability was notably exploited by the Santy.A worm and has multiple public exploit modules, including a Metasploit module, indicating widespread knowledge and ease of exploitation, despite limited recent community discussion or media coverage.