20371Third-party advisory
http://secunia.com/advisories/20371 CVE-2006-2908
MyBulletinBoard (MyBB) < 1.1.3 - Remote Code Execution
Record summary
CVE-2006-2908 has a selected CVSS score of 7.5; EIP currently links 1 catalogued exploit.
Description
The domecode function in inc/functions_post.php in MyBulletinBoard (MyBB) 1.1.2, and possibly other versions, allows remote attackers to execute arbitrary PHP code via the username field, which is used in a preg_replace function call with a /e (executable) modifier.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBMyBulletinBoard (MyBB) < 1.1.3 - Remote Code ExecutionExploitDB exploitby Javier OlascoagaNot analyzed1 file
References
12secunia.com
http://secunia.com/secunia_research/2006-40/advisory 1086Third-party advisory
http://securityreason.com/securityalert/1086 1016270vdb entry
http://securitytracker.com/id?1016270 514.es
http://www.514.es/download/mybibi.pl 26216vdb entry
http://www.osvdb.org/26216 20060612 Secunia Research: MyBB "domecode()" PHP Code ExecutionVulnerabilitymailing list
http://www.securityfocus.com/archive/1/436767/100/0/threaded 20060613 Proof of concept: mybb 1.1.2 remote code executionmailing list
http://www.securityfocus.com/archive/1/437509/100/100/threaded 18396vdb entry
http://www.securityfocus.com/bid/18396 ADV-2006-2288vdb entry
http://www.vupen.com/english/advisories/2006/2288 mybb-domecode-code-execution(27046)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/27046 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2006-2908