PT-2008-5669 · Icebb · Icebb

Publicado 2008-10-03 · Atualizado 2017-08-08 · CVE-2008-4431

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: IceBB versions 1.0-rc9.3 and earlier

Description: The issue is related to a SQL injection vulnerability. It allows remote attackers to execute arbitrary SQL commands via the skin parameter. This is likely due to an incorrect protection mechanism in the clean string function.

Recommendations: For IceBB versions 1.0-rc9.3 and earlier, consider restricting access to the skin parameter in the index.php file until a patch is available. As a temporary workaround, review and modify the clean string function in includes/functions.php to properly protect against SQL injection attacks.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-4431

Produtos afetados

Icebb

Referências · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/44403 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4431 · Nota de Segurança
• http://secunia.com/advisories/31439 · Aviso do Fabricante
• http://securityfocus.com/bid/30656 · Nota
• http://forums.xaos-ia.com/?topic=765 · Nota