CVE-2006-2335: Code Injection
Jelsoft vBulletin accepts uploads of Cascading Style Sheets (CSS) and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a CSS file that contains PHP code, then selecting the file via the style chooser, which causes the PHP code to be executed. NOTE: the vendor was unable to reproduce this issue in 3.5.x. NOTE: this issue might be due to direct static code injection.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2335?
CVE-2006-2335 is considered a critical vulnerability due to its potential for remote shell access.
How do I fix CVE-2006-2335?
To fix CVE-2006-2335, it is recommended to upgrade to a version of vBulletin that does not allow the execution of PHP code within CSS files.
Who is affected by CVE-2006-2335?
Users of Jelsoft vBulletin version 3.5.8 are affected by CVE-2006-2335.
What impact does CVE-2006-2335 have on vBulletin installations?
CVE-2006-2335 allows remote authenticated administrators to execute arbitrary PHP code, potentially compromising the server.
Can CVE-2006-2335 be exploited without authentication?
No, CVE-2006-2335 requires authenticated access to exploit the vulnerability.