Description
Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote attackers to gain access via modified user_env, pass_env, power_env, and id_env parameters in a cookie, which comprise a persistent logon that does not vary across sessions.
References
- http://www.kliconsulting.com/users/mbrooks/UPB_0-day.txt
- 1138 third-party-advisory
- 20060620 ULtimate PHP Board <= 1.96 GOLD Code Execution (exploit code) mailing-list