MyBulletinBoard UserCP.PHP Directory Traversal Vulnerability
BID:19195
CVE-2006-3954 |Info
MyBulletinBoard UserCP.PHP Directory Traversal Vulnerability
| Bugtraq ID: | 19195 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 27 2006 12:00AM |
| Updated: | Aug 09 2006 06:50PM |
| Credit: | Roozbeh Afrasiabi is credited with the discovery of this vulnerability. |
| Vulnerable: |
MyBulletinBoard MyBulletinBoard 1.1.7 MyBulletinBoard MyBulletinBoard 1.1.6 MyBulletinBoard MyBulletinBoard 1.1.5 MyBulletinBoard MyBulletinBoard 1.1.4 MyBulletinBoard MyBulletinBoard 1.1.3 MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBulletinBoard 1.1.1 MyBulletinBoard MyBulletinBoard 1.1 MyBulletinBoard MyBulletinBoard 1.0.4 MyBulletinBoard MyBulletinBoard 1.0.3 MyBulletinBoard MyBulletinBoard 1.0.2 MyBulletinBoard MyBulletinBoard 1.0.1 MyBulletinBoard MyBulletinBoard 1.0 PR2 MyBulletinBoard MyBulletinBoard 1.0 MyBulletinBoard MyBulletinBoard RC4 MyBulletinBoard MyBulletinBoard RC3 MyBulletinBoard MyBulletinBoard RC2 MyBulletinBoard MyBulletinBoard RC1 MyBulletinBoard MyBulletinBoard 1.2 MyBulletinBoard MyBulletinBoard 1.10 |
| Not Vulnerable: | |
Discussion
MyBulletinBoard UserCP.PHP Directory Traversal Vulnerability
MyBulletinBoard is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.
MyBulletinBoard is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.
Exploit / POC
MyBulletinBoard UserCP.PHP Directory Traversal Vulnerability
Attackers may exploit this vulnerability via a web client.
The following proof of concept is available:
Attackers may exploit this vulnerability via a web client.
The following proof of concept is available:
Solution / Fix
MyBulletinBoard UserCP.PHP Directory Traversal Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please email us at: [email protected]:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please email us at: [email protected]:[email protected].
References
MyBulletinBoard UserCP.PHP Directory Traversal Vulnerability
References:
References:
- MyBulletinBoard Home Page (MyBulletinBoard)