Unscored CVE-2006-4271 EUVD-2006-4259GHSA-867q-2qrx-4h8m

PHP remote file inclusion vulnerability in install/upgrade_301.php in Jelsoft vBulletin 3.5.4 allows remote attackers to execute arbitrary …

Published Aug 21, 2006 · Updated Aug 7, 2024 · Assigned by mitre

Description

PHP remote file inclusion vulnerability in install/upgrade_301.php in Jelsoft vBulletin 3.5.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter. NOTE: the vendor has disputed this vulnerability, saying "The default vBulletin requires authentication prior to the usage of the upgrade system.

References

20060705 Re: vBulletin 3.5.4 (install_path) Exploit mailing-list
20060711 RE: Re: vBulletin 3.5.4 (install_path) Exploit mailing-list
20060708 Re: Re: vBulletin 3.5.4 (install_path) Exploit mailing-list
20060705 vBulletin 3.5.4 (install_path) Exploit mailing-list
http://www.pldsoft.com/forum/showthread.php?t=1340
28210 vdb-entry