PT-2007-6020 · Nuclearbb · Nuclearbb

Infection · Published 2007-09-17 · Updated 2018-10-15 · CVE-2007-4906

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: NuclearBB Alpha 2

Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the root path parameter when register globals is enabled. This is due to a PHP remote file inclusion vulnerability in the tasks/send queued emails.php file.

Recommendations: For NuclearBB Alpha 2, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the tasks/send queued emails.php file to minimize the risk of arbitrary PHP code execution. Avoid using the root path parameter in the affected file until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-4906

Affected Products

Nuclearbb

References · 6

• 🔥 https://exploit-db.com/exploits/4395 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4906 · Security Note
• http://securityfocus.com/archive/1/479086/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36556 · Note
• http://osvdb.org/38978 · Note
• http://securityreason.com/securityalert/3142 · Note