PT-2006-1219 · Pd9 · Megabbs

Publicado 2006-01-09 · Atualizado 2017-07-20 · CVE-2006-0139

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PD9 Software MegaBBS version 2.1

Description The issue concerns the send-private-message functionality, specifically the "send-private-message.asp" endpoint, which allows remote attackers to read private messages of other users. This is achieved by modifying the replyid parameter.

Recommendations For PD9 Software MegaBBS version 2.1, consider restricting access to the "send-private-message.asp" endpoint until a patch is available. As a temporary workaround, avoid using the modified replyid parameter in the send-private-message functionality to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-0139

Produtos afetados

Megabbs

Referências · 8

• 🔥 http://hamid.ir/security/megabbs.txt · Exploit
• 🔥 http://secunia.com/advisories/18342 · Exploit
• http://pd9soft.com/megabbs/forums/thread-view.asp?tid=4924 · Aviso do Fabricante
• http://securityfocus.com/bid/16168 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2006-0139 · Nota de Segurança
• http://vupen.com/english/advisories/2006/0095 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24050 · Nota
• http://securitytracker.com/id?1015452 · Nota