CVEvulnerability
CVE-2007-6396
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-12-17
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inject arbitrary PHP code via the (1) username, (2) password, and (3) email parameters when registering a user account, which can be executed by accessing the user's php file for this account. NOTE: similar code injection might be possible in a user profile.
Affected configurations
• myupb flat php board 1.2
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://osvdb.org/43675 osvdb.org
- http://www.securityfocus.com/archive/1/484803/100/100/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/26782 www.securityfocus.com
- https://www.exploit-db.com/exploits/4705 www.exploit-db.com
- http://osvdb.org/43675 osvdb.org
- http://www.securityfocus.com/archive/1/484803/100/100/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/26782 www.securityfocus.com
- https://www.exploit-db.com/exploits/4705 www.exploit-db.com