PT-2007-1431 · Minibb · Minibb Forum

The-Lord-Of-Cracking · Publicado 2007-03-07 · Atualizado 2018-10-16 · CVE-2006-7153

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MiniBB Forum version 2

Description The issue allows remote attackers to execute arbitrary code via a URL in the pathToFiles parameter in the index.php file.

Recommendations For MiniBB Forum version 2, update the index.php file to properly validate and sanitize the pathToFiles parameter to prevent remote file inclusion attacks. As a temporary workaround, consider restricting access to the index.php file or disabling the pathToFiles parameter until a patch is available.

Correção

Identificadores relacionados

CVE-2006-7153

Produtos afetados

Minibb Forum

Referências · 5

• http://securityreason.com/securityalert/2371 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-7153 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30253 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7153 · Nota
• http://securityfocus.com/archive/1/451402/100/0/threaded · Nota