CVE-2006-2739 - PHP remote file inclusion vulnerability in footers.php in Epicdesigns tinyBB 0.3, when register_glob

CVE-2006-2739

Summary

PHP remote file inclusion vulnerability in footers.php in Epicdesigns tinyBB 0.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the tinybb_footers parameter. Successful exploitation requires that "register_globals" is enabled.

References

Vulnerable Configurations

cpe:2.3:a:epic_designs:tinybb:*:*:*:*:*:*:*:*
cpe:2.3:a:epic_designs:tinybb:*:*:*:*:*:*:*:*

CVSS

Base:	5.1 (as of 18-10-2018 - 16:41)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:H/Au:N/C:P/I:P/A:P

refmap via4

bid	18147
bugtraq	20060528 Advisory: tinyBB <= 0.3 Multiple Remote Vulnerabilities. 20080130 tinyBB v0.2 Message Board Remote File Inc.
misc	http://www.nukedx.com/?getxpl=33 http://www.nukedx.com/?viewdoc=33
sectrack	1016172
secunia	20356
sreason	1011
vupen	ADV-2006-2035
xf	tinybb-footers-file-include(26824)

Last major update

18-10-2018 - 16:41

Published

01-06-2006 - 10:02

Last modified

18-10-2018 - 16:41