PT-2003-1483 · Yabb · Yabb Se

Dalibor Karlovic + 1 · Published 2003-05-14 · Updated 2016-10-18 · CVE-2003-0275

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: YaBB SE version 1.5.2

Description: The issue allows remote attackers to execute arbitrary PHP code. This is achieved by modifying the sourcedir parameter to reference a URL on a remote web server that contains the malicious code.

Recommendations: For YaBB SE version 1.5.2, avoid using the sourcedir parameter to reference external URLs until a patch is available. As a temporary workaround, consider restricting access to the SSI.php file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2003-0275

Affected Products

Yabb Se

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2003-0275 · Security Note
• http://marc.info/?l=bugtraq&m=105249980809988&w=2 · Note