NavBoard Admin_config.PHP Arbitrary Code Execution Vulnerability

Bugtraq ID:	24120
Class:	Input Validation Error
CVE:	CVE-2007-2899
Remote:	Yes
Local:	No
Published:	May 23 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Dj7xpl is credited with the discovery of this vulnerability.
Vulnerable:	Nortel Networks SRG V16
Not Vulnerable:

NavBoard Admin_config.PHP Arbitrary Code Execution Vulnerability

NavBoard is prone to an arbitrary-code-execution vulnerability.

An attacker can exploit this vulnerability to create and execute arbitrary script code in the context of the webserver process.

NavBoard 1.6.0 is vulnerable to this issue.

Note that to exploit this vulnerability, the attacker must have administrative privileges to the application.

NavBoard Admin_config.PHP Arbitrary Code Execution Vulnerability

Attackers can use a browser to exploit this issue.

Sample exploit code has been provided:

• /data/vulnerabilities/exploits/24120.php

NavBoard Admin_config.PHP Arbitrary Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NavBoard Admin_config.PHP Arbitrary Code Execution Vulnerability

References:

• Navboard Homepage (Navboard)