CVE-2006-5511

Direct static code injection vulnerability in delete.php in JaxUltraBB (JUBB) 2.0, when register_globals is enabled, allows remote attackers to inject arbitrary web script, HTML, or PHP via the contents parameter, whose value is prepended to the file specified by the forum parameter.

CVSS v2.0 2.6 LOW

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://attrition.org/pipermail/vim/2006-October/001095.html	Exploit
http://www.securityfocus.com/bid/20679	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/29711
https://www.exploit-db.com/exploits/2616
http://attrition.org/pipermail/vim/2006-October/001095.html	Exploit
http://www.securityfocus.com/bid/20679	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/29711
https://www.exploit-db.com/exploits/2616

Configurations

Configuration 1 (hide)

cpe:2.3:a:jaxultrabb:jaxultrabb:2.0:*:*:*:*:*:*:*

History

21 Nov 2024, 00:19

Type	Values Removed	Values Added
References	~~() http://attrition.org/pipermail/vim/2006-October/001095.html - Exploit~~	() http://attrition.org/pipermail/vim/2006-October/001095.html - Exploit
References	~~() http://www.securityfocus.com/bid/20679 - Exploit~~	() http://www.securityfocus.com/bid/20679 - Exploit
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/29711 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/29711 -
References	~~() https://www.exploit-db.com/exploits/2616 -~~	() https://www.exploit-db.com/exploits/2616 -

Information

Published : 2006-10-25 22:07

Updated : 2024-11-21 00:19

NVD link : CVE-2006-5511

Mitre link : CVE-2006-5511

CVE.ORG link : CVE-2006-5511

JSON object : View

Products Affected

jaxultrabb

jaxultrabb

CWE

NVD-CWE-Other

{"id": "CVE-2006-5511", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-10-25T22:07:00.000", "references": [{"url": "http://attrition.org/pipermail/vim/2006-October/001095.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/20679", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29711", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/2616", "source": "cve@mitre.org"}, {"url": "http://attrition.org/pipermail/vim/2006-October/001095.html", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/20679", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29711", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/2616", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Direct static code injection vulnerability in delete.php in JaxUltraBB (JUBB) 2.0, when register_globals is enabled, allows remote attackers to inject arbitrary web script, HTML, or PHP via the contents parameter, whose value is prepended to the file specified by the forum parameter."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n directa de c\u00f3digo est\u00e1tico en el archivo delete.php en el JaxUltraBB (JUBB) 2.0, cuando el registro global est\u00e1 habilitado, permite a atacantes remotos la inyecci\u00f3n de c\u00f3digo web ejecutable de su elecci\u00f3n, HTML o PHP a trav\u00e9s de los par\u00e1metros de contenido, cuyo valor se incluye en un fichero especificado en el par\u00e1metro forum."}], "lastModified": "2024-11-21T00:19:31.613", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jaxultrabb:jaxultrabb:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01433C3D-4F98-4B80-9006-7A9FAD4E8D54"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}