Executive Summary

Informations
Name CVE-2003-0395 First vendor Publication 2003-07-02
Vendor Cve Last vendor Modification 2024-02-13

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Ultimate PHP Board (UPB) 1.9 allows remote attackers to execute arbitrary PHP code with UPB administrator privileges via an HTTP request containing the code in the User-Agent header, which is executed when the administrator executes admin_iplog.php.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0395

CAPEC : Common Attack Pattern Enumeration & Classification

Id Name
CAPEC-18 Embedding Scripts in Nonscript Elements
CAPEC-35 Leverage Executable Code in Nonexecutable Files
CAPEC-63 Simple Script Injection
CAPEC-73 User-Controlled Filename
CAPEC-77 Manipulating User-Controlled Variables
CAPEC-81 Web Logs Tampering
CAPEC-85 Client Network Footprinting (using AJAX/XSS)
CAPEC-86 Embedding Script (XSS ) in HTTP Headers

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-94 Failure to Control Generation of Code ('Code Injection')

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

Open Source Vulnerability Database (OSVDB)

Id Description
12052 Ultimate PHP Board (UPB) admin_iplog.php User-Agent Header Arbitrary Code Exe...

Snort® IPS/IDS

Date Description
2014-11-16 Ultimate PHP Board admin_iplog remote code execution attempt
RuleID : 31546 - Revision : 2 - Type : SERVER-WEBAPP

Nessus® Vulnerability Scanner

Date Description
2003-05-29 Name : The remote host has a PHP script that may allow arbitrary code execution on t...
File : upb_code_injection.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BUGTRAQ http://marc.info/?l=bugtraq&m=105379741528925&w=2
MISC http://f0kp.iplus.ru/bz/024.en.txt

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
Date Informations
2024-02-13 21:27:59
  • Multiple Updates
2021-05-04 12:02:03
  • Multiple Updates
2021-04-22 01:02:09
  • Multiple Updates
2020-05-23 00:15:24
  • Multiple Updates
2016-10-18 12:01:11
  • Multiple Updates
2014-11-16 21:24:18
  • Multiple Updates
2014-02-17 10:26:12
  • Multiple Updates
2013-05-11 11:51:18
  • Multiple Updates