CVE-2006-4631
MEDIUM 6.5EPSS 3.1%
Direct static code injection vulnerability in admin/save_opt.php in SoftBB 0.1, and possibly earlier, allows remote authenticated users to upload and execute arbitrary PHP code via the cache_forum parameter, which saves the code to info_options.php, which is accessible via a direct request.
- CVSS v2.0 NVD
- 6.5 MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P - EPSS
- 3.08% chance of exploitation in the next 30 days, 88th percentile
- Published
- 2006-09-08
- Updated
- 2024-08-07
Proof-of-concept exploits (2)
- https://www.exploit-db.com/exploits/2300
- http://www.securityfocus.com/archive/1/445087/100/0/threaded