CVE-2006-4631

SoftBB < 0.1 - Authenticated Direct Static Code Injection via cache_forum Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2006-4631. PoCs published by DarkFig, Kacper.

AI-analyzed exploit summary This exploit targets SoftBB 0.1 by leveraging an authenticated PHP code execution vulnerability. It bypasses security mechanisms like magic_quotes_gpc and register_globals to inject a shellcode payload into the application's configuration, allowing remote command execution.

Description

Direct static code injection vulnerability in admin/save_opt.php in SoftBB 0.1, and possibly earlier, allows remote authenticated users to upload and execute arbitrary PHP code via the cache_forum parameter, which saves the code to info_options.php, which is accessible via a direct request.

Exploits (2)

exploitdb WORKING POC VERIFIED
by DarkFig · perlwebappsphp
https://www.exploit-db.com/exploits/2300

This exploit targets SoftBB 0.1 by leveraging an authenticated PHP code execution vulnerability. It bypasses security mechanisms like magic_quotes_gpc and register_globals to inject a shellcode payload into the application's configuration, allowing remote command execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: SoftBB 0.1
Auth required
Prerequisites: Valid admin credentials · Access to the admin panel
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Kacper · phpwebappsphp
https://www.exploit-db.com/exploits/28488

This exploit targets a local file inclusion vulnerability in PHP-Proxima 6.0, allowing arbitrary file reading and remote code execution via crafted HTTP requests. It automates the attack by testing multiple log file paths and injecting commands through the vulnerable 'bb_smilies.php' script.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: PHP-Proxima 6.0
No auth needed
Prerequisites: register_globals=On · magic_quotes_gpc=Off · access to vulnerable PHP-Proxima installation
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (9)

Core 9
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/2300
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21761
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/28579
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3478
Exploit vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1016785
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/1521
Exploit, Vendor Advisory x_refsource_misc
http://acid-root.new.fr/advisories/10060904.txt
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/28749
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/445087/100/0/threaded

Scores

EPSS 0.0292
EPSS Percentile 85.2%

Details

Status published
Products (1)
softbb/softbb < 0.1
Published Sep 08, 2006
Tracked Since Feb 18, 2026