CVE-2006-3208

Direct static code injection vulnerability in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified "configuration fields" in (1) admin_chatconfig.php, (2) admin_configcss.php, (3) admin_config.php, or (4) admin_config2.php, which are stored as configuration settings. NOTE: this issue can be exploited by remote attackers by leveraging other vulnerabilities in UPB.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.kliconsulting.com/users/mbrooks/UPB_0-day.txt	Exploit
http://securityreason.com/securityalert/1138
http://www.securityfocus.com/archive/1/437875/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ultimate_php_board:ultimate_php_board:1.9.6:::::::*
	cpe:2.3:a:ultimate_php_board:ultimate_php_board:1.8:::::::*
	cpe:2.3:a:ultimate_php_board:ultimate_php_board:1.8.2:::::::*
	cpe:2.3:a:ultimate_php_board:ultimate_php_board:1.9:::::::*

Information

Published : 2006-06-23 18:06

Updated : 2018-10-18 09:46

NVD link : CVE-2006-3208

Mitre link : CVE-2006-3208

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

ultimate_php_board

ultimate_php_board

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.kliconsulting.com/users/mbrooks/UPB_0-day.txt", "name": "http://www.kliconsulting.com/users/mbrooks/UPB_0-day.txt", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://securityreason.com/securityalert/1138", "name": "1138", "tags": [], "refsource": "SREASON"}, {"url": "http://www.securityfocus.com/archive/1/437875/100/0/threaded", "name": "20060620 ULtimate PHP Board <= 1.96 GOLD Code Execution (exploit code)", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Direct static code injection vulnerability in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified \"configuration fields\" in (1) admin_chatconfig.php, (2) admin_configcss.php, (3) admin_config.php, or (4) admin_config2.php, which are stored as configuration settings. NOTE: this issue can be exploited by remote attackers by leveraging other vulnerabilities in UPB."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-3208", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2006-06-24T01:06Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ultimate_php_board:ultimate_php_board:1.9.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ultimate_php_board:ultimate_php_board:1.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ultimate_php_board:ultimate_php_board:1.8.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ultimate_php_board:ultimate_php_board:1.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-18T16:46Z"}