CVE-2006-4271: High severity Jelsoft vBulletin vulnerability
DISPUTED PHP remote file inclusion vulnerability in install/upgrade301.php in Jelsoft vBulletin 3.5.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter. NOTE: the vendor has disputed this vulnerability, saying "The default vBulletin requires authentication prior to the usage of the upgrade system."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-4271?
The severity of CVE-2006-4271 is considered medium due to the potential for remote code execution.
How do I fix CVE-2006-4271?
To fix CVE-2006-4271, it is recommended to upgrade vBulletin to a version that is not affected by this vulnerability.
What software is affected by CVE-2006-4271?
CVE-2006-4271 affects vBulletin version 3.5.4.
Can CVE-2006-4271 be exploited without authentication?
CVE-2006-4271 can potentially be exploited without authentication if certain configurations are in place.
Is there any known workaround for CVE-2006-4271?
A known workaround for CVE-2006-4271 is to restrict access to the install/upgrade_301.php file.