PT-2007-6020 · Nuclearbb · Nuclearbb

Infection · Publicado 2007-09-17 · Atualizado 2018-10-15 · CVE-2007-4906

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: NuclearBB Alpha 2

Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the root path parameter when register globals is enabled. This is due to a PHP remote file inclusion vulnerability in the tasks/send queued emails.php file.

Recommendations: For NuclearBB Alpha 2, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the tasks/send queued emails.php file to minimize the risk of arbitrary PHP code execution. Avoid using the root path parameter in the affected file until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-4906

Produtos afetados

Nuclearbb

Referências · 6

• 🔥 https://exploit-db.com/exploits/4395 · Exploit
• http://securityfocus.com/archive/1/479086/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36556 · Nota
• http://osvdb.org/38978 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4906 · Nota de Segurança
• http://securityreason.com/securityalert/3142 · Nota