Unrated severityNVD Advisory· Published Sep 13, 2006· Updated Apr 16, 2026
CVE-2006-4759
CVE-2006-4759
Description
PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenticated administrative users to upload arbitrary files and execute code, as demonstrated by a query to admin_options.php with an avatars_dir parameter ending in %00. NOTE: this issue was originally disputed by the vendor, but the dispute was withdrawn on 20060926.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- www.security.nnov.ru/Odocument221.htmlnvdExploit
- forums.punbb.org/viewtopic.phpnvd
- www.attrition.org/pipermail/vim/2006-September/001041.htmlnvd
- www.attrition.org/pipermail/vim/2006-September/001052.htmlnvd
- www.attrition.org/pipermail/vim/2006-September/001055.htmlnvd
- www.securityfocus.com/archive/1/445788/100/0/threadednvd
- www.securityfocus.com/archive/1/446420/100/0/threadednvd
- exchange.xforce.ibmcloud.com/vulnerabilities/28884nvd
News mentions
0No linked articles in our index yet.