CVE-2006-3208

Direct static code injection vulnerability in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified "configuration fields" in (1) admin_chatconfig.php, (2) admin_configcss.php, (3) admin_config.php, or (4) admin_config2.php, which are stored as configuration settings. NOTE: this issue can be exploited by remote attackers by leveraging other vulnerabilities in UPB.

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.35% chance of exploitation in the next 30 days, 70th percentile

Published

2006-06-24

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.securityfocus.com/archive/1/437875/100/0/threaded

References

• CVE Record
• NVD entry

Related

• CVE-2006-3207
• CVE-2006-3210
• CVE-2006-3206
• CVE-2006-3213
• CVE-2006-3205
• CVE-2006-3221