CVE-2006-6790

Ultimate PHP Board 2.0b1 - '/chat/login.php' Code Execution

Severity Score

7.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Direct static code injection vulnerability in chat/login.php in Ultimate PHP Board (UPB) 2.0b1 and earlier allows remote attackers to inject arbitrary PHP code via the username parameter, which is injected into chat/text.php.

Vulnerabilidad de inyección directa de código estático en chat/login.php de Ultimate PHPBoard (UPB) 2.0b1 y anteriores permite a atacantes remotos inyectar código PHP de su elección a través del parámetro user, el cual es inyectado en chat/text.php.

*Credits: N/A

CVSS Scores

NISTv2 7.5

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2006-12-24 First Exploit
2006-12-27 CVE Reserved
2006-12-28 CVE Published
2024-05-22 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (4)

URL	Tag	Source
http://www.securityfocus.com/bid/21760	Vdb Entry
http://www.securityfocus.com/data/vulnerabilities/exploits/21760.pl	X_refsource_misc
http://www.vupen.com/english/advisories/2006/5181	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/2999	2006-12-24

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Ultimate Php Board Search vendor "Ultimate Php Board"		Ultimate Php Board Search vendor "Ultimate Php Board" for product "Ultimate Php Board"				<= 2.0_beta_1 Search vendor "Ultimate Php Board" for product "Ultimate Php Board" and version " <= 2.0_beta_1"		-		Affected