CVEvulnerability

CVE-2006-3208

6.5 MEDIUM Published 2006-06-24 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-06-24
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P

Description

Direct static code injection vulnerability in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified "configuration fields" in (1) admin_chatconfig.php, (2) admin_configcss.php, (3) admin_config.php, or (4) admin_config2.php, which are stored as configuration settings. NOTE: this issue can be exploited by remote attackers by leveraging other vulnerabilities in UPB.

Affected configurations

• ultimate php board ultimate php board 1.8 • ultimate php board ultimate php board 1.8.2 • ultimate php board ultimate php board 1.9 • ultimate php board ultimate php board 1.9.6

References