CVE-2006-5511

JaxUltraBB 2.0 - Code Injection

Title source: llm

Description

Direct static code injection vulnerability in delete.php in JaxUltraBB (JUBB) 2.0, when register_globals is enabled, allows remote attackers to inject arbitrary web script, HTML, or PHP via the contents parameter, whose value is prepended to the file specified by the forum parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Kacper · phpwebappsphp

https://www.exploit-db.com/exploits/2616

View Code ZIP pw:eip

References (4)

[Exploit] http://attrition.org/pipermail/vim/2006-October/001095.html

[Exploit] http://www.securityfocus.com/bid/20679

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/29711

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/2616

Scores

EPSS 0.0386

EPSS Percentile 88.2%

Details

Status published

Products (1)

jaxultrabb/jaxultrabb 2.0

Published Oct 25, 2006

Tracked Since Feb 18, 2026