FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-4759

This CVE name corresponds to:

Entered	Topic
2006-09-30	punbb -- NULL byte injection vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-4759 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-4759
Phase	Assigned(20060913)

Description

PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenticated administrative users to upload arbitrary files and execute code, as demonstrated by a query to admin_options.php with an avatars_dir parameter ending in %00. NOTE: this issue was originally disputed by the vendor, but the dispute was withdrawn on 20060926.

References

Source	Reference
BUGTRAQ	20060911 ShAnKaR: multiple PHP application poison NULL byte vulnerability
BUGTRAQ	20060919 Re: ShAnKaR: multiple PHP application poison NULL byte vulnerability
MISC	http://www.security.nnov.ru/Odocument221.html
VIM	20060919 Dispute - CVE-2006-4759 - PunBB
VIM	20060925 PunBB - more
VIM	20060926 PunBB - more
CONFIRM	http://forums.punbb.org/viewtopic.php?id=13255
XF	phpbb-nullbyte-file-upload(28884)