PT-2006-5892 · Deluxebb · Deluxebb

Published 2006-10-03 · Updated 2024-02-14 · CVE-2006-5154

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DeluxeBB versions 1.09 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the templatefolder parameter. This can be exploited by providing a malicious URL to the vulnerable parameter, potentially leading to code execution.

Recommendations For DeluxeBB versions 1.09 and earlier, consider disabling the cp/sig.php script until a patch is available or apply any available security patches to prevent exploitation. Avoid using the templatefolder parameter with untrusted input to minimize the risk of code execution.

Exploit

Fix

Related Identifiers

CVE-2006-5154

Affected Products

Deluxebb

References · 9

• 🔥 http://securityfocus.com/bid/20292 · Exploit
• 🔥 https://exploit-db.com/exploits/28736 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5154 · Security Note
• http://secunia.com/advisories/22176 · Vendor Advisory
• http://deluxebb.com/community/topic.php?tid=420 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29305 · Note
• http://vupen.com/english/advisories/2006/3857 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5154 · Note
• http://osvdb.org/29371 · Note