CVE-2006-4759

PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenticated administrative users to upload arbitrary…

published September 13, 2006

CVSS
—
EPSS
2%
Percentile
83.1
In the wild
Unconfirmed
What it is

PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenticated administrative users to upload arbitrary files and execute code, as demonstrated by a query to admin_options.php with an avatars_dir parameter ending in %00. NOTE: this issue was originally disputed by the vendor, but the dispute was withdrawn on 20060926.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02297 · 83.1th percentile
Published
2006-09-13T23:00Z
EPSS history
Timeline
  • 13 SEP 23:00Z
    PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenticated administrative users to upload arbitrary…
    cvelistv5