Shmilyltyo

**Name of the Vulnerable Software and Affected Versions** HYBBS2 versions 2.3.2 and earlier **Description** The issue allows for arbitrary file upload via a crafted ZIP archive. This is possible due to a problem in the `update code` function in `Admin.php`. **Recommendations** For HYBBS2 versions 2.3.2 and earlier, consider disabling the `update code` function in `Admin.php` to prevent arbitrary file uploads until a fix is available. Restrict access to the `Admin.php` file to minimize the risk of exploitation. Avoid using the `update code` function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** HYBBS2 versions 2.3.2 and earlier **Description** The issue allows remote code execution because it writes plugin-related configuration information to conf.php. This is due to a problem in Admin.php. **Recommendations** For HYBBS2 versions 2.3.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.