Published: 28/03/2007 Updated: 19/10/2017

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 940

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

SQL injection vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to execute arbitrary SQL commands via the filename of an uploaded file to the avatar function, as demonstrated by setting admin privileges.

Vulnerable Product	Search on Vulmon	Subscribe to Product
icebb icebb 1.0_rc_5

#!/usr/bin/perl # IceBB 10-rc5 Remote Create Admin Exploit # 1 register a user # 2 run this exploit with this usage : $perl xplpl [host&path] [uname] [pass] # 3 login with admin access :) # - magic_quotes_gpc = Off # #### Coded & Discovered By Hessam-x / Hessamx-at-Hessamxnet use LWP::UserAgent; use HTTP::Cookies; $port = "80"; ...

#!/usr/bin/perl # IceBB 10-rc5 Remote Code Execution Exploit # 1 register a user # 2 run this exploit with this usage : $perl xplpl [host&path] [uname] [pass] # 3 login with admin access :) # # #### Coded & Discovered By Hessam-x / Hessamx-at-Hessamxnet use LWP::UserAgent; use HTTP::Cookies; $port = "80"; $host = $ARGV[0]; $un ...

NVD-CWE-Other http://secunia.com/advisories/24644 http://www.securityfocus.com/bid/23158 http://osvdb.org/34497 http://www.vupen.com/english/advisories/2007/1116 https://exchange.xforce.ibmcloud.com/vulnerabilities/33240 https://www.exploit-db.com/exploits/3581 https://www.exploit-db.com/exploits/3580 https://nvd.nist.gov https://www.exploit-db.com/exploits/3580/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2007-1725

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect