Description
Multiple PHP remote file inclusion vulnerabilities in PBSite allow remote attackers to execute arbitrary PHP code via a URL in the (1) dbpath parameter to (a) useronline.php, (b) ucp.php, (c) setcookie.php, (d) sendpm.php, (e) search.php, (f) register.php, (g) profile.php, (h) post.php, (i) pmpshow.php, (j) pm.php, (k) ntopic.php, (l) nreply.php, (m) news.php, (n) memberslist.php, (o) logout.php, (p) login.php, (q) index.php, (r) help.php, (s) forum.php, (t) error.php, (u) editpost.php, (v) delpost.php, (w) delpm.php, (x) confirm.php, (y) board.php, (z) admin2.php, (aa) admin.php, or (bb) templates/pb/css/formstyles.php; or the (2) temppath parameter to (a) useronline.php, (c) setcookie.php, (e) search.php, (f) register.php, (h) post.php, (l) nreply.php, (m) news.php, (o) logout.php, (p) login.php, (q) index.php, (r) help.php, (s) forum.php, (t) error.php, (w) delpm.php, (x) confirm.php, or (y) board.php.
References
- 38763 vdb-entry
- 38780 vdb-entry
- 38767 vdb-entry
- 38759 vdb-entry
- 20070601 PBSite - PHP Bulletin Site | CMS ====> RFI mailing-list
- 20070602 PBSite - PHP Bulletin Site | CMS ====> RFI mailing-list
- 38781 vdb-entry
- 38776 vdb-entry
- 38762 vdb-entry
- 38771 vdb-entry
- 38777 vdb-entry
- 38784 vdb-entry
- 38775 vdb-entry
- 2777 third-party-advisory
- 38779 vdb-entry
- 38778 vdb-entry
- 38770 vdb-entry
- 38760 vdb-entry
- 38785 vdb-entry
- 38774 vdb-entry
- 38773 vdb-entry
- 38761 vdb-entry
- 38768 vdb-entry
- 38769 vdb-entry
- 38782 vdb-entry
- 38783 vdb-entry
- 38764 vdb-entry
- 38786 vdb-entry
- pbsite-dbpathtemppath-file-include(34675) vdb-entry
- 38772 vdb-entry
- 38765 vdb-entry
- 38766 vdb-entry