CVE-2006-5137 Information

Description

Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme[] array parameter to admin/doedittheme.php which is injected into includes/theme.inc.php; (2) inject PHP code via a config[] array parameter to admin/doeditconfig.php and then execute the code via includes/config.inc.php; and inject a reference to PHP code via a URL in the config[path] parameter and then execute the code via (3) dorateuser.php (4) calendar.php and unspecified other scripts.

Reference

http://securityreason.com/securityalert/1676 http://www.securityfocus.com/archive/1/447359/100/0/threaded http://www.securityfocus.com/bid/20266 https://exchange.xforce.ibmcloud.com/vulnerabilities/29274