CVE-2007-1725

SQL injection vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to execute arbitrary SQL commands via the filename of an uploaded file to the avatar function, as demonstrated by setting admin privileges.

CVSS v2.0 NVD

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

1.80% chance of exploitation in the next 30 days, 78th percentile

Published

2007-03-28

Updated

2024-08-07

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/3581
• https://www.exploit-db.com/exploits/3580

Security advisories

• http://secunia.com/advisories/24644
• http://www.securityfocus.com/bid/23158

References

• CVE Record
• NVD entry