CVE-2007-1255 Unrestricted file upload vulnerability in admin.bbcode.php in Connectix Boards 0.7 and earlier allows remote authenticated administrators to execute arbitrary PHP code by uploading a crafted GIF smile...
MediumCVSS 6.0
EPSS 0.91%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Unrestricted file upload vulnerability in admin.bbcode.php in Connectix Boards 0.7 and earlier allows remote authenticated administrators to execute arbitrary PHP code by uploading a crafted GIF smiley image with a .php extension via the uploadimage parameter to admin.php, which can be later accessed via a direct request for the file in smileys/. NOTE: this can be leveraged with a separate SQL injection issue for remote unauthenticated attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| connectix boards | = 0.4 | No fix listed |
| connectix boards | = 0.4.1 | No fix listed |
| connectix boards | = 0.4.2 | No fix listed |
| connectix boards | = 0.4.3 | No fix listed |
| connectix boards | = 0.4.4 | No fix listed |
| connectix boards | = 0.5 | No fix listed |
| connectix boards | = 0.5.1 | No fix listed |
| connectix boards | = 0.5.2 | No fix listed |
| connectix boards | = 0.5.3 | No fix listed |
| connectix boards | = 0.5.4 | No fix listed |
| connectix boards | = 0.5.5 | No fix listed |
| connectix boards | = 0.6 | No fix listed |
| connectix boards | = 0.6.1 | No fix listed |
| connectix boards | = 0.7 | No fix listed |
References
- 33538 vdb-entry
- 24255 exploit third-party-advisory vendor-advisory
- 2364 third-party-advisory
- 20070221 Connectix Boards <= 0.7 (p_skin) Multiple Vulnerabilities Exploit mailing-list
- 3352 exploit