Unscored severity · published May 12, 2006
CVE-2006-2318
Incomplete blacklist vulnerability in Ideal Science Ideal BB 1.5.4a and earlier allows remote attackers to upload and execute an ASP script via a ".asa" file, which bypasses the…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Incomplete blacklist vulnerability in Ideal Science Ideal BB 1.5.4a and earlier allows remote attackers to upload and execute an ASP script via a ".asa" file, which bypasses the check for the ".asp" extension but is executable on the server.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ID
Idealbb · Ideal Science
1.4.9; 1.4.9_beta; 1.4.9a; 1.5.0_beta1; 1.5.0_beta2; 1.5.0_beta3; +19 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-2318
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-2318
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045887.html
Vendor Advisory
http://secunia.com/advisories/20035
securityreason.com
http://securityreason.com/securityalert/871
Patch
http://www.idealscience.com/ibb/posts.aspx?postID=24415
www.osvdb.org
http://www.osvdb.org/25456
www.securityfocus.com
http://www.securityfocus.com/archive/1/433248/100/0/threaded
More from Idealbb
–
CVE-2006-2321
Multiple cross-site scripting (XSS) vulnerabilities in Ideal Science Ideal BB 1.5.4a and earlier allow remote attackers to inject arbitrary web script or HTML via unknown vectors
–
CVE-2006-2319
Ideal Science Ideal BB 1.5.4a and earlier does not properly check file extensions before permitting an upload, which allows remote attackers to upload and execute an ASP script…
–
CVE-2006-2320
Multiple SQL injection vulnerabilities in Ideal Science Ideal BB 1.5.4a and earlier allow remote attackers to execute arbitrary SQL commands via multiple unspecified vectors…
–
CVE-2006-2317
Unspecified vulnerability in Ideal Science Ideal BB 1.5.4a and earlier allows remote attackers to read arbitrary files under the web root via unspecified attack vectors related to…
–
CVE-2004-2208
CRLF injection vulnerability in Ideal Science IdealBB 1.4.9 through 1.5.3 allows remote attackers to conduct HTTP response splitting attacks via unknown vectors