1. Home
  2. CVE Database
  3. CVE-2006-4759
LOW · 3.6

CVE-2006-4759

PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenticated administrative users to upload arbitrary files and execute code, as demonstrated by ...

Vulnerability Description

PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenticated administrative users to upload arbitrary files and execute code, as demonstrated by a query to admin_options.php with an avatars_dir parameter ending in %00. NOTE: this issue was originally disputed by the vendor, but the dispute was withdrawn on 20060926.

CVSS Score

3.6

LOW

AV:N/AC:H/Au:S/C:N/I:P/A:P
Confidentiality
NONE
Integrity
PARTIAL
Availability
PARTIAL

Affected Products

VendorProductVersions
PunbbPunbb1.2.12

References

FAQ

What is CVE-2006-4759?

CVE-2006-4759 is a vulnerability with a CVSS score of 3.6 (LOW). PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenticated administrative users to upload arbitrary files and execute code, as demonstrated by ...

How severe is CVE-2006-4759?

CVE-2006-4759 has been rated LOW with a CVSS base score of 3.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2006-4759?

Check the references section above for vendor advisories and patch information. Affected products include: Punbb Punbb.