CVE-2007-3208

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-06-14 · updated 2026-06-16

Description

CRLF injection vulnerability in Yet another Bulletin Board (YaBB) 2.1 allows remote attackers to obtain administrative access via requests to (1) register.pl or (2) profile.pl that write CRLF sequences to a .vars file. NOTE: this can be leveraged to execute arbitrary code.

Affected products

YaBB: 2.1

References

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=538
http://osvdb.org/37236
http://osvdb.org/37237
http://secunia.com/advisories/25656
http://www.securityfocus.com/bid/24455
http://www.securitytracker.com/id?1018236
http://www.yabbforum.com/community/?board=general%3Baction=display%3Bnum=1181678785
https://exchange.xforce.ibmcloud.com/vulnerabilities/34848
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=538
http://osvdb.org/37236
http://osvdb.org/37237
http://secunia.com/advisories/25656

Get alerted when CVE-2007-3208 or the next vulnerability affects your stack