CVE

Id
21241  
CVE No.
CVE-2006-5137  
Status
Candidate  
Description
Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme[] array parameter to admin/doedittheme.php, which is injected into includes/theme.inc.php; (2) inject PHP code via a config[] array parameter to admin/doeditconfig.php, and then execute the code via includes/config.inc.php; and inject a reference to PHP code via a URL in the config[path] parameter, and then execute the code via (3) dorateuser.php, (4) calendar.php, and unspecified other scripts.  
Phase
Assigned (20061002)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
201922 21241 CVE-2006-5137 BUGTRAQ:20060929 UBB.threads Multiple input validation error  View
201923 21241 CVE-2006-5137 URL:http://www.securityfocus.com/archive/1/archive/1/447359/100/0/threaded  View
201924 21241 CVE-2006-5137 BID:20266  View
201925 21241 CVE-2006-5137 URL:http://www.securityfocus.com/bid/20266  View
201926 21241 CVE-2006-5137 SREASON:1676  View
201927 21241 CVE-2006-5137 URL:http://securityreason.com/securityalert/1676  View
201928 21241 CVE-2006-5137 XF:ubbthreads-multiple-file-include(29274)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
59943 JVNDB-2006-002209 MkPortal における Web サイトコンテンツを破損される脆弱性 MkPortal は、Urlobox に関する処理に不備があるため、Web サイトコンテンツが破損されるなどの脆弱性が存在します。 CVE-2006-5139 21241 5 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-002209.html  View