PT-2005-3662 · Fudforum · Fudforum

Riklaunim · Published 2005-09-02 · Updated 2018-10-19 · CVE-2005-2781

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FUD Forum versions prior to 2.7.0

Description The issue concerns the Avatar upload feature, which fails to properly verify uploaded files. This allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension that contains image data followed by PHP code.

Recommendations For versions prior to 2.7.0, update to version 2.7.0 or later to resolve the issue. As a temporary workaround, consider disabling the Avatar upload feature until a patch is available. Restrict access to the upload module to minimize the risk of exploitation. Avoid using the Avatar upload feature in the affected versions until the issue is resolved.

Fix

Related Identifiers

CVE-2005-2781

DSA-1063-1

Affected Products

Fudforum

References · 9

• http://debian.org/security/2006/dsa-1063 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2781 · Security Note
• http://secunia.com/advisories/16627 · Vendor Advisory
• http://securityfocus.com/archive/1/500406/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22076 · Note
• http://secunia.com/advisories/20203 · Note
• http://marc.info/?l=bugtraq&m=112534235403406&w=2 · Note
• http://securityfocus.com/bid/14678 · Note
• http://fudforum.org/forum/index.php?t=msg&th=5470&start=0& · Note