CVE-2006-3208

CVE-2006-3208 is a direct static code injection vulnerability affecting Ultimate PHP Board (UPB) versions 1.9.6 and earlier. Authenticated administrators can execute arbitrary PHP code by injecting malicious code into various configuration fields within admin_chatconfig.php, admin_configcss.php, admin_config.php, or admin_config2.php. With a CVSS score of 6.5 (Medium), this vulnerability requires authentication (AV:N/AC:L/Au:S) and can lead to partial compromise of confidentiality, integrity, and availability (C:P/I:P/A:P). While it requires administrator privileges, it can be leveraged by remote attackers exploiting other UPB vulnerabilities. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. Its EPSS score is low, suggesting a minimal threat likelihood.