Login Request a demo
Unscored severity · published May 12, 2006
CVE-2006-2319
Ideal Science Ideal BB 1.5.4a and earlier does not properly check file extensions before permitting an upload, which allows remote attackers to upload and execute an ASP script…
–
CVSS
1.9%
EPSS
No
On KEV
Description
Ideal Science Ideal BB 1.5.4a and earlier does not properly check file extensions before permitting an upload, which allows remote attackers to upload and execute an ASP script via a 0x00 character before the ".asp" portion of the filename.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ID
Idealbb · Ideal Science
1.5.0_beta1; 1.5.0_beta2; 1.5.0_beta3; 1.5.0_beta4; 1.5.0_rc1; 1.5.1; +10 more · source: NVD
Affected product
ID
Idealbb
Ideal Science
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-2319
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-2319
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045887.html
secunia.com
http://secunia.com/advisories/20035
securityreason.com
http://securityreason.com/securityalert/871
www.idealscience.com
http://www.idealscience.com/ibb/posts.aspx?postID=24415
www.osvdb.org
http://www.osvdb.org/25456
www.securityfocus.com
http://www.securityfocus.com/archive/1/433248/100/0/threaded
More from Idealbb
–
CVE-2006-2321
Multiple cross-site scripting (XSS) vulnerabilities in Ideal Science Ideal BB 1.5.4a and earlier allow remote attackers to inject arbitrary web script or HTML via unknown vectors
–
CVE-2006-2318
Incomplete blacklist vulnerability in Ideal Science Ideal BB 1.5.4a and earlier allows remote attackers to upload and execute an ASP script via a ".asa" file, which bypasses the…
–
CVE-2006-2320
Multiple SQL injection vulnerabilities in Ideal Science Ideal BB 1.5.4a and earlier allow remote attackers to execute arbitrary SQL commands via multiple unspecified vectors…
–
CVE-2006-2317
Unspecified vulnerability in Ideal Science Ideal BB 1.5.4a and earlier allows remote attackers to read arbitrary files under the web root via unspecified attack vectors related to…
–
CVE-2004-2208
CRLF injection vulnerability in Ideal Science IdealBB 1.4.9 through 1.5.3 allows remote attackers to conduct HTTP response splitting attacks via unknown vectors