JaxUltraBB Topic Reply Remote PHP Script Code Execution Vulnerability

Bugtraq ID:	20738
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 25 2006 12:00AM
Updated:	Oct 26 2006 05:58PM
Credit:	BlackHawk is credited with discovering this vulnerability.
Vulnerable:	JaxUltraBB JaxUltraBb 2.0
Not Vulnerable:

JaxUltraBB Topic Reply Remote PHP Script Code Execution Vulnerability

JaxUltraBB is prone to an remote PHP code-execution vulnerability because the application fails to sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary code with the privileges of the webserver process.

JaxUltraBB 2.0 and prior versions are vulnerable to this issue.

JaxUltraBB Topic Reply Remote PHP Script Code Execution Vulnerability

Attackers can exploit this issue via a web client.

The following exploit code is available:

• /data/vulnerabilities/exploits/20748.php

JaxUltraBB Topic Reply Remote PHP Script Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

JaxUltraBB Topic Reply Remote PHP Script Code Execution Vulnerability

References:

• Vendor Home Page (JaxUltraBB)