Description
CRLF injection vulnerability in Yet another Bulletin Board (YaBB) 2.1 allows remote attackers to obtain administrative access via requests to (1) register.pl or (2) profile.pl that write CRLF sequences to a .vars file. NOTE: this can be leveraged to execute arbitrary code.
References
- 1018236 vdb-entry
- 24455 vdb-entry
- http://www.yabbforum.com/community/?board=general%3Baction=display%3Bnum=1181678785
- 37237 vdb-entry
- 20070612 YaBB Forum member.vars CRLF third-party-advisory
- 25656 third-party-advisory
- yabb-vars-privilege-escalation(34848) vdb-entry
- 37236 vdb-entry