CVE-2005-4135 Direct static code injection vulnerability in includes/newtopic.php in SimpleBBS 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the Host header (poss...
HighCVSS 7.5
EPSS 8.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Direct static code injection vulnerability in includes/newtopic.php in SimpleBBS 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the Host header (possibly the name parameter or variable), which is then written to data/topics.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simplemedia simplebbs | = 1.0.6 | No fix listed |
| simplemedia simplebbs | = 1.0.7 | No fix listed |
| simplemedia simplebbs | = 1.1 | No fix listed |
References
- 17949 third-party-advisory vendor-advisory
- 1015323 vdb-entry
- 20051207 SimpleBBS <= v1.1 remote commands execution in c by: unitedasia security crew mailing-list
- 15764 exploit vdb-entry
- ADV-2005-2807 vdb-entry