PT-2012-5161 · Pbboard · Pbboard

CVE-2012-4036 · Published 2012-08-27 · Updated 2024-02-14

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PBBoard version 2.1.4

Description The issue allows remote administrators to execute arbitrary PHP code by uploading a file with an executable extension to the addons directory via admin.php, and then accessing it directly. This can be exploited by remote attackers.

Recommendations For PBBoard version 2.1.4, consider restricting access to the admin.php file and the addons directory to prevent unauthorized file uploads. As a temporary workaround, restrict the ability to upload files with executable extensions to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2012-4036

Affected Products

Pbboard

References · 9

• 🔥 http://pbboard.com/forums/t10353.html · Exploit
• 🔥 http://securityfocus.com/bid/54916 · Exploit
• 🔥 https://exploit-db.com/exploits/37616 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-4036 · Security Note
• http://secunia.com/advisories/50153 · Vendor Advisory
• http://pbboard.com/forums/t10352.html · Vendor Advisory
• http://osvdb.org/84479 · Note
• https://htbridge.com/advisory/HTB23101 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77508 · Note