IceBB Avatar Upload Remote PHP Code Execution Vulnerability
BID:23151
Info
IceBB Avatar Upload Remote PHP Code Execution Vulnerability
| Bugtraq ID: | 23151 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 26 2007 12:00AM |
| Updated: | Mar 27 2007 07:23PM |
| Credit: | Hessam-x is credited with the discovery of this vulnerability. |
| Vulnerable: |
IceBB Avatar 1.0-rc5 |
| Not Vulnerable: | |
Discussion
IceBB Avatar Upload Remote PHP Code Execution Vulnerability
IceBB is prone to an arbitrary PHP code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary malicious PHP code by uploading malicious PHP files. This may help the attacker compromise the application and the underlying system; other attacks are also possible.
Version 1.0-rc5 is vulnerable to this issue; other versions may also be affected.
IceBB is prone to an arbitrary PHP code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary malicious PHP code by uploading malicious PHP files. This may help the attacker compromise the application and the underlying system; other attacks are also possible.
Version 1.0-rc5 is vulnerable to this issue; other versions may also be affected.
Exploit / POC
IceBB Avatar Upload Remote PHP Code Execution Vulnerability
Attackers can use a browser to exploit this issue.
The following proof-of-concept exploit is available:
Attackers can use a browser to exploit this issue.
The following proof-of-concept exploit is available:
Solution / Fix
IceBB Avatar Upload Remote PHP Code Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].