PT-2005-3000 · Infopop · Ubb.Threads

Publicado 2005-06-28 · Atualizado 2016-10-18 · CVE-2005-2058

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Infopop UBB.Threads versions prior to 6.5.2 Beta

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via various parameters to different API endpoints, such as the Number parameter to "download.php", "modifypost.php", "mailthread.php", or "notifymod.php", the month or year parameter to "calendar.php", the message parameter to "viewmessage.php", the main parameter to "addfav.php", or the posted parameter to "grabnext.php".

Recommendations: For Infopop UBB.Threads versions prior to 6.5.2 Beta, update to version 6.5.2 Beta or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is available. Avoid using the vulnerable parameters, such as Number, month, year, message, main, and posted, in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-2058

Produtos afetados

Ubb.Threads

Referências · 12

• 🔥 https://exploit-db.com/exploits/25903 · Exploit
• 🔥 https://exploit-db.com/exploits/25901 · Exploit
• 🔥 https://exploit-db.com/exploits/25900 · Exploit
• 🔥 http://gulftech.org/?node=research&article_id=00084-06232005 · Exploit
• 🔥 https://exploit-db.com/exploits/25898 · Exploit
• 🔥 https://exploit-db.com/exploits/1069 · Exploit
• 🔥 https://exploit-db.com/exploits/25899 · Exploit
• 🔥 https://exploit-db.com/exploits/25902 · Exploit
• 🔥 https://exploit-db.com/exploits/25897 · Exploit
• http://ubbcentral.com/boards/showflat.php/Cat/0/Number/42351/Main/42351/#Post42351 · Correção
• http://marc.info/?l=bugtraq&m=111963737202040&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2058 · Nota de Segurança