high7.5Public exploit code
CVE-2003-0770
FUNC.pm in IkonBoard 3.1.2a and earlier, including 3.1.1, does not properly cleanse the "lang" cookie when it contains illegal characters, which allows remote …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- IkonBoard 3.1 - Lang Cookie Arbitrary Command Execution (2)2003-05-05 · webapps · cgi · Verified
- IkonBoard 3.1 - Lang Cookie Arbitrary Command Execution (1)2003-04-15 · webapps · cgi · Verified
Impact
FUNC.pm in IkonBoard 3.1.2a and earlier, including 3.1.1, does not properly cleanse the "lang" cookie when it contains illegal characters, which allows remote attackers to execute arbitrary code when the cookie is inserted into a Perl "eval" statement.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ikonboard.Com | Ikonboard | Versions 3.1.1, 3.1.2a |
References
- NVD record
- CVE.org record
- http://marc.info/?l=bugtraq&m=106381136115972&w=2
- http://www.securityfocus.com/archive/1/317234
- http://www.securityfocus.com/archive/1/336598
- http://marc.info/?l=bugtraq&m=106381136115972&w=2
- http://www.securityfocus.com/archive/1/317234
- http://www.securityfocus.com/archive/1/336598