PT-2004-1477 · Xmb Forum · Xmb

Janek Vind + 1 · Publicado 2004-03-18 · Atualizado 2021-04-29 · CVE-2004-0323

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XMB versions 1.8 Final SP2 through 1.9 beta

Description The issue allows remote attackers to inject arbitrary SQL and gain privileges. This can be achieved via several parameters in different PHP files, including the ppp parameter in "viewthread.php", the desc parameter in "misc.php", the tpp parameter in "forumdisplay.php", the ascdesc parameter in "forumdisplay.php", or the addon parameter in "stats.php".

Recommendations For XMB version 1.8 Final SP2, consider disabling the SQL injection prone parameters ppp, desc, tpp, ascdesc, and addon in their respective PHP files until a patch is available. For XMB version 1.9 beta, restrict access to the tpp parameter in "forumdisplay.php" to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2004-0323

Produtos afetados

Xmb

Referências · 9

• 🔥 http://securityfocus.com/bid/9726 · Exploit
• 🔥 https://exploit-db.com/exploits/23748 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15295 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html · Nota
• http://xmbforum.com/community/boards/viewthread.php?tid=746859 · Nota
• https://docs.xmbforum2.com/index.php?title=Security_Issue_History · Nota
• http://marc.info/?l=bugtraq&m=107756526625179&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0323 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.html · Nota