PT-2006-5416 · Softbb · Softbb

Darkfig · Published 2006-09-08 · Updated 2018-10-17 · CVE-2006-4631

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SoftBB versions 0.1 and earlier

Description The issue allows remote authenticated users to upload and execute arbitrary PHP code via the cache forum parameter in the admin/save opt.php file. This parameter saves the code to info options.php, which can be accessed via a direct request.

Recommendations For SoftBB versions 0.1 and earlier, avoid using the cache forum parameter in the admin/save opt.php file until a fix is available. As a temporary workaround, consider restricting access to the info options.php file to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-4631

Affected Products

Softbb

References · 11

• 🔥 https://exploit-db.com/exploits/2300 · Exploit
• 🔥 https://exploit-db.com/exploits/28488 · Exploit
• 🔥 http://securitytracker.com/id?1016785 · Exploit
• 🔥 http://acid-root.new.fr/advisories/10060904.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4631 · Security Note
• http://securityreason.com/securityalert/1521 · Note
• http://secunia.com/advisories/21761 · Note
• http://osvdb.org/28579 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28749 · Note
• http://vupen.com/english/advisories/2006/3478 · Note
• http://securityfocus.com/archive/1/445087/100/0/threaded · Note