CVE-2006-4558 DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileuplo...
HighCVSS 7.5
EPSS 4.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileupload parameter in a newthread action in newpost.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| deluxebb | <= 1.06 | No fix listed |
References
- 20060516 DeluxeBB <= v1.06 attachment mod_mime exploit broken-link exploit mailing-list
- retrogod.altervista.org broken-link exploit
- 20135 broken-link patch third-party-advisory vendor-advisory
- 1492 exploit third-party-advisory
- ADV-2006-1843 broken-link vdb-entry
- deluxebb-modmime-file-upload(26485) third-party-advisory vdb-entry