PT-2007-3092 · Icebb · Icebb

Hessam-X · Published 2007-03-28 · Updated 2017-10-19 · CVE-2007-1726

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: IceBB versions 1.0-rc5

Description: The issue concerns an unrestricted file upload vulnerability. This vulnerability allows remote authenticated users to upload arbitrary files via the avatar function in index.php. These uploaded files can later be accessed in the uploads/ directory.

Recommendations: For IceBB version 1.0-rc5, consider restricting the types of files that can be uploaded through the avatar function to prevent the upload of malicious files. As a temporary workaround, restrict access to the uploads/ directory to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-1726

Affected Products

Icebb

References · 7

• 🔥 https://exploit-db.com/exploits/3581 · Exploit
• http://secunia.com/advisories/24644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1726 · Security Note
• http://osvdb.org/34498 · Note
• http://securityfocus.com/bid/23151 · Note
• http://vupen.com/english/advisories/2007/1116 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33242 · Note