high7.5Public exploit code
CVE-2010-2099
bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attac…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- e107 - Code Exection2010-05-24 · webapps · multiple · Verified
Impact
bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attackers to execute arbitrary PHP code, as demonstrated using the toEmail method in contact.php, related to invocations of the toHTML method.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| E107 | E107 | through 0.7.20 Versions 0.6_10, 0.6_11, 0.6_12, 0.6_13, 0.6_14 |
Weakness classification
References
- NVD record
- CVE.org record
- http://php-security.org/2010/05/19/mops-2010-035-e107-bbcode-remote-php-code-execution-vulnerability/index.html
- http://www.securityfocus.com/bid/40252
- http://php-security.org/2010/05/19/mops-2010-035-e107-bbcode-remote-php-code-execution-vulnerability/index.html
- http://www.securityfocus.com/bid/40252