CVE-2013-2267

HIGH

FUDforum 3.0.4 - Remote Code Execution via PHP Code Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2013-2267. PoCs published by High-Tech Bridge.

AI-analyzed exploit summary This exploit leverages a PHP code injection vulnerability in FUDforum's admreplace.php by manipulating the regex_str and regex_with parameters to execute arbitrary PHP code (e.g., phpinfo()). The attack requires an authenticated session and exploits insufficient input sanitization.

Description

PHP Code Injection vulnerability in FUDforum Bulletin Board Software 3.0.4 could allow remote attackers to execute arbitrary code on the system.

Exploits (1)

exploitdb WORKING POC VERIFIED
by High-Tech Bridge · textwebappsphp
https://www.exploit-db.com/exploits/38418

This exploit leverages a PHP code injection vulnerability in FUDforum's admreplace.php by manipulating the regex_str and regex_with parameters to execute arbitrary PHP code (e.g., phpinfo()). The attack requires an authenticated session and exploits insufficient input sanitization.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: FUDforum 3.0.4
Auth required
Prerequisites: Authenticated session (valid fud_session cookie) · Access to admreplace.php
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/58845
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/83229

Scores

CVSS v3 7.2
EPSS 0.0883
EPSS Percentile 94.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (1)
fudforum/fudforum 3.0.4
Published Jan 27, 2020
Tracked Since Feb 18, 2026