PT-2007-3092 · Icebb · Icebb

Hessam-X · Publicado 2007-03-28 · Atualizado 2017-10-19 · CVE-2007-1726

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: IceBB versions 1.0-rc5

Description: The issue concerns an unrestricted file upload vulnerability. This vulnerability allows remote authenticated users to upload arbitrary files via the avatar function in index.php. These uploaded files can later be accessed in the uploads/ directory.

Recommendations: For IceBB version 1.0-rc5, consider restricting the types of files that can be uploaded through the avatar function to prevent the upload of malicious files. As a temporary workaround, restrict access to the uploads/ directory to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-1726

Produtos afetados

Icebb

Referências · 7

• 🔥 https://exploit-db.com/exploits/3581 · Exploit
• http://osvdb.org/34498 · Nota
• http://securityfocus.com/bid/23151 · Nota
• http://secunia.com/advisories/24644 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/1116 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1726 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33242 · Nota