Vulnerability Description
Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inject arbitrary PHP code via the (1) username, (2) password, and (3) email parameters when registering a user account, which can be executed by accessing the user's php file for this account. NOTE: similar code injection might be possible in a user profile.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Myupb | Flat Php Board | 1.2 |
Related Weaknesses (CWE)
References
- http://osvdb.org/43675
- http://www.securityfocus.com/archive/1/484803/100/100/threaded
- http://www.securityfocus.com/bid/26782
- https://www.exploit-db.com/exploits/4705
- http://osvdb.org/43675
- http://www.securityfocus.com/archive/1/484803/100/100/threaded
- http://www.securityfocus.com/bid/26782
- https://www.exploit-db.com/exploits/4705
FAQ
What is CVE-2007-6396?
CVE-2007-6396 is a vulnerability with a CVSS score of 7.5 (HIGH). Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inject arbitrary PHP code via the (1) username, (2) password, and (3) email paramet...
How severe is CVE-2007-6396?
CVE-2007-6396 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-6396?
Check the references section above for vendor advisories and patch information. Affected products include: Myupb Flat Php Board.