CVE-2007-1725 SQL injection vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to execute arbitrary SQL commands via the filename of an uploaded file to the avatar function, as demonstrat...
HighCVSS 9.3
EPSS 1.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to execute arbitrary SQL commands via the filename of an uploaded file to the avatar function, as demonstrated by setting admin privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| icebb | = 1.0_rc_5 | No fix listed |
References
- 34497 vdb-entry
- 24644 third-party-advisory vendor-advisory
- 23158 vdb-entry
- ADV-2007-1116 vdb-entry
- icebb-index-sql-injection(33240) vdb-entry
- 3580 exploit
- 3581 exploit