PT-2007-1431 · Minibb · Minibb Forum

The-Lord-Of-Cracking · Published 2007-03-07 · Updated 2018-10-16 · CVE-2006-7153

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MiniBB Forum version 2

Description The issue allows remote attackers to execute arbitrary code via a URL in the pathToFiles parameter in the index.php file.

Recommendations For MiniBB Forum version 2, update the index.php file to properly validate and sanitize the pathToFiles parameter to prevent remote file inclusion attacks. As a temporary workaround, consider restricting access to the index.php file or disabling the pathToFiles parameter until a patch is available.

Fix

Related Identifiers

CVE-2006-7153

Affected Products

Minibb Forum

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-7153 · Security Note
• http://securityreason.com/securityalert/2371 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30253 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7153 · Note
• http://securityfocus.com/archive/1/451402/100/0/threaded · Note