CVE-2006-5511

Published Oct 25, 2006

Last updated 7 years ago

Overview

Description: Direct static code injection vulnerability in delete.php in JaxUltraBB (JUBB) 2.0, when register_globals is enabled, allows remote attackers to inject arbitrary web script, HTML, or PHP via the contents parameter, whose value is prepended to the file specified by the forum parameter.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 2.6
Impact score: 2.9
Exploitability score: 4.9
Vector string: AV:N/AC:H/Au:N/C:N/I:P/A:N

Weaknesses

nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:jaxultrabb:jaxultrabb:2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "01433C3D-4F98-4B80-9006-7A9FAD4E8D54"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References