Description
Incomplete blacklist vulnerability in Ideal Science Ideal BB 1.5.4a and earlier allows remote attackers to upload and execute an ASP script via a ".asa" file, which bypasses the check for the ".asp" extension but is executable on the server.
References
- 25456 vdb-entry
- 20035 third-party-advisory
- 20060508 Multiple Vulnerabilities In IdealBB ASP Bulletin Board mailing-list
- ADV-2006-1729 vdb-entry
- 20060508 Multiple Vulnerabilities In IdealBB ASP Bulletin Board mailing-list
- 17920 vdb-entry
- idealbb-asp-file-upload(26353) vdb-entry
- 871 third-party-advisory
- http://www.idealscience.com/ibb/posts.aspx?postID=24415