CVE-2006-3208

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.35%

Published

Jun 24, 2006

Modified

Jun 16, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Direct static code injection vulnerability in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified "configuration fields" in (1) admin_chatconfig.php, (2) admin_configcss.php, (3) admin_config.php, or (4) admin_config2.php, which are stored as configuration settings. NOTE: this issue can be exploited by remote attackers by leveraging other vulnerabilities in UPB.

Affected Products (4)

ultimate_php_board · ultimate_php_boardvulnerable

References (6)

http://securityreason.com/securityalert/1138

http://www.kliconsulting.com/users/mbrooks/UPB_0-day.txt

ExploitURL Repurposed

http://www.securityfocus.com/archive/1/437875/100/0/threaded

http://securityreason.com/securityalert/1138

http://www.kliconsulting.com/users/mbrooks/UPB_0-day.txt

ExploitURL Repurposed

http://www.securityfocus.com/archive/1/437875/100/0/threaded

KEV Catalog EPSS Scores Vendors All CVEs