CVE-2006-5137

Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme[] array…

published October 2, 2006

CVSS
—
EPSS
2%
Percentile
82.3
In the wild
Unconfirmed
What it is

Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme[] array parameter to admin/doedittheme.php, which is injected into includes/theme.inc.php; (2) inject PHP code via a config[] array parameter to admin/doeditconfig.php, and then execute the code via includes/config.inc.php; and inject a reference to PHP code via a URL in the config[path] parameter, and then execute the code via (3) dorateuser.php, (4) calendar.php, and unspecified other scripts.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02197 · 82.3th percentile
Published
2006-10-02T20:00Z
EPSS history
Timeline
  • 02 OCT 20:00Z
    Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme[] array…
    cvelistv5