Zeroboard 4.1, when the allow_url_fopen and register_globals variables are enabled, allows remote attackers to execute arbitrary PHP code by modifying the _zb_path parameter to reference a URL on a remote web server that contains the code.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Zeroboard | Zeroboard | 4.1_pl2 (including) | 4.1_pl2 (including) |