Description
Multiple PHP remote file inclusion vulnerabilities in free QBoard 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the qb_path parameter to (1) index.php, (2) about.php, (3) contact.php, (4) delete.php, (5) faq.php, (6) features.php or (7) history.php, a different set of vectors than CVE-2006-2998.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 7
- free QBoard 1.1 - 'index.php?qb_path' Remote File Inclusion EDB-28150 · webapps · Jul 3, 2006 · verified
- free QBoard 1.1 - 'about.php?qb_path' Remote File Inclusion EDB-28151 · webapps · Jul 3, 2006 · verified
- free QBoard 1.1 - 'contact.php?qb_path' Remote File Inclusion EDB-28152 · webapps · Jul 3, 2006 · verified
- free QBoard 1.1 - 'delete.php?qb_path' Remote File Inclusion EDB-28153 · webapps · Jul 3, 2006 · verified
- free QBoard 1.1 - 'faq.php?qb_path' Remote File Inclusion EDB-28154 · webapps · Jul 3, 2006 · verified
- free QBoard 1.1 - 'features.php?qb_path' Remote File Inclusion EDB-28155 · webapps · Jul 3, 2006 · verified
- free QBoard 1.1 - 'history.php?qb_path' Remote File Inclusion EDB-28156 · webapps · Jul 3, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 18788 vdb-entry
- 28059 vdb-entry
- 28064 vdb-entry
- 20060702 free QBoard v1.1 Multiple Remote File include mailing-list
- 28060 vdb-entry
- 28062 vdb-entry
- freeqboard-multiple-scripts-file-include(27040) vdb-entry
- 28065 vdb-entry
- 28063 vdb-entry
- 20061201 freeqboard <= 1.1 (qb_path) Remote File Include Vulnerability mailing-list
- 1233 third-party-advisory
- 1016433 vdb-entry
- 21394 vdb-entry
- 28061 vdb-entry