CVE-2006-3208 | BDVDB-2026-17736 Detail

Description#

Direct static code injection vulnerability in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified "configuration fields" in (1) admin_chatconfig.php, (2) admin_configcss.php, (3) admin_config.php, or (4) admin_config2.php, which are stored as configuration settings. NOTE: this issue can be exploited by remote attackers by leveraging other vulnerabilities in UPB.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.kliconsulting.com/users/mbrooks/UPB_0-day.txt
http://securityreason.com/securityalert/1138
http://www.securityfocus.com/archive/1/437875/100/0/threaded

Exploit#

No public exploit known

History#

Version 12006-06-24Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.