CVE-2007-2236 - Vulnerability Details - OpenCVE

footer.php in PunBB 1.2.14 and earlier allows remote attackers to include local files in include/user/ via a cross-site scripting (XSS) attack, or via the pun_include tag, as demonstrated by use of admin_options.php to execute PHP code from an uploaded avatar file.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Punbb	Punbb

Configuration 1 [-]

cpe:2.3:a:punbb:punbb:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://dev.punbb.org/changeset/937
http://secunia.com/advisories/24843
http://securityreason.com/securityalert/2613
http://www.acid-root.new.fr/advisories/13070411.txt
http://www.securityfocus.com/archive/1/465338/100/100/threaded
http://www.securityfocus.com/archive/1/465400/100/100/threaded
http://www.vupen.com/english/advisories/2007/1362

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-04-25T15:00:00

Updated: 2024-08-07T13:33:27.451Z

Reserved: 2007-04-25T00:00:00

Link: CVE-2007-2236

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-04-25T15:19:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-2236

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-04-11T00:00:00", "descriptions": [{"lang": "en", "value": "footer.php in PunBB 1.2.14 and earlier allows remote attackers to include local files in include/user/ via a cross-site scripting (XSS) attack, or via the pun_include tag, as demonstrated by use of admin_options.php to execute PHP code from an uploaded avatar file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://dev.punbb.org/changeset/937"}, {"name": "20070411 PunBB <= 1.2.14 Remote Code Execution (Exploit)", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/465338/100/100/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://www.acid-root.new.fr/advisories/13070411.txt"}, {"name": "24843", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/24843"}, {"name": "2613", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/2613"}, {"name": "ADV-2007-1362", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/1362"}, {"name": "20070411 PunBB <= 1.2.14 Multiple Vulnerabilities (Advisory)", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/465400/100/100/threaded"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-2236", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "footer.php in PunBB 1.2.14 and earlier allows remote attackers to include local files in include/user/ via a cross-site scripting (XSS) attack, or via the pun_include tag, as demonstrated by use of admin_options.php to execute PHP code from an uploaded avatar file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://dev.punbb.org/changeset/937", "refsource": "CONFIRM", "url": "http://dev.punbb.org/changeset/937"}, {"name": "20070411 PunBB <= 1.2.14 Remote Code Execution (Exploit)", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/465338/100/100/threaded"}, {"name": "http://www.acid-root.new.fr/advisories/13070411.txt", "refsource": "MISC", "url": "http://www.acid-root.new.fr/advisories/13070411.txt"}, {"name": "24843", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/24843"}, {"name": "2613", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/2613"}, {"name": "ADV-2007-1362", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/1362"}, {"name": "20070411 PunBB <= 1.2.14 Multiple Vulnerabilities (Advisory)", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/465400/100/100/threaded"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T13:33:27.451Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://dev.punbb.org/changeset/937"}, {"name": "20070411 PunBB <= 1.2.14 Remote Code Execution (Exploit)", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/465338/100/100/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.acid-root.new.fr/advisories/13070411.txt"}, {"name": "24843", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/24843"}, {"name": "2613", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/2613"}, {"name": "ADV-2007-1362", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/1362"}, {"name": "20070411 PunBB <= 1.2.14 Multiple Vulnerabilities (Advisory)", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/465400/100/100/threaded"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-2236", "datePublished": "2007-04-25T15:00:00", "dateReserved": "2007-04-25T00:00:00", "dateUpdated": "2024-08-07T13:33:27.451Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:punbb:punbb:*:*:*:*:*:*:*:*", "matchCriteriaId": "EA3BC172-F516-44C0-8277-3B0643C83482", "versionEndIncluding": "1.2.14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "footer.php in PunBB 1.2.14 and earlier allows remote attackers to include local files in include/user/ via a cross-site scripting (XSS) attack, or via the pun_include tag, as demonstrated by use of admin_options.php to execute PHP code from an uploaded avatar file."}, {"lang": "es", "value": "footer.php de PunBB 1.2.14 y versiones anteriores permite a atacantes remotos incluir ficheros locales en include/user/ mediante un ataque de secuencias de comandos en sitios cruzados (XSS), \u00f3 mediante la etiqueta pun_include, como se demuestra al usar admin_options.php para ejecutar c\u00f3digo PHP de un fichero avatar promocionado."}], "id": "CVE-2007-2236", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-04-25T15:19:00.000", "references": [{"source": "cve@mitre.org", "url": "http://dev.punbb.org/changeset/937"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/24843"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/2613"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.acid-root.new.fr/advisories/13070411.txt"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/465338/100/100/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/465400/100/100/threaded"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/1362"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://dev.punbb.org/changeset/937"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/24843"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/2613"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.acid-root.new.fr/advisories/13070411.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/465338/100/100/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/465400/100/100/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/1362"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}