CVE-2007-3208 CRLF injection vulnerability in Yet another Bulletin Board (YaBB) 2.1 allows remote attackers to obtain administrative access via requests to (1) register.pl or (2) profile.pl that write CRLF sequence...
HighCVSS 10.0
EPSS 5.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CRLF injection vulnerability in Yet another Bulletin Board (YaBB) 2.1 allows remote attackers to obtain administrative access via requests to (1) register.pl or (2) profile.pl that write CRLF sequences to a .vars file. NOTE: this can be leveraged to execute arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yabb | = 2.1 | No fix listed |
References
- 20070612 YaBB Forum member.vars CRLF third-party-advisory
- 37236 vdb-entry
- 37237 vdb-entry
- 25656 patch third-party-advisory vendor-advisory
- 24455 patch vdb-entry
- 1018236 vdb-entry
- www.yabbforum.com
- yabb-vars-privilege-escalation(34848) vdb-entry