PT-2007-1673 · Geobb · Geobb

Published 2007-01-11 · Updated 2024-08-07 · CVE-2007-0189

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GeoBB Georgian Bulletin Board versions prior to 1.0

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the action parameter in the index.php file. However, it's noted that GeoBB 1.0 sets $action to a whitelisted value, which disputes the severity of this issue.

Recommendations For versions prior to 1.0, consider restricting access to the action parameter in the index.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-0189

Affected Products

Geobb

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-0189 · Security Note
• http://osvdb.org/33440 · Note
• https://t.me/cvenotify/89622 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31335 · Note
• http://attrition.org/pipermail/vim/2007-January/001230.html · Note
• http://securityfocus.com/archive/1/456251/100/0/threaded · Note
• http://securityreason.com/securityalert/2141 · Note