Krasza

**Name of the Vulnerable Software and Affected Versions** Yet another Bulletin Board (YaBB) versions 2.1 and earlier **Description** The issue allows remote authenticated users to execute arbitrary Perl code via a .. (dot dot) in the `userlanguage` profile setting. This setting affects the `language` variable in files such as HelpCentre.pl and ICQPager.pl, the `use lang` variable in Subs.pl, and the `actlang` variable in Post.pl and InstantMessage.pl. An example of exploitation involves modifying the English/HelpCentre.lng file to contain Perl statements and then invoking the help action in YaBB.pl. **Recommendations** For Yet another Bulletin Board (YaBB) versions 2.1 and earlier, as a temporary workaround, consider restricting access to the `userlanguage` profile setting to prevent unauthorized modifications. Additionally, avoid using the `userlanguage` key in the member hash until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: PHP-Nuke versions 8.0 Final and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands via the `HTTP REFERER` variable in the HTTP Referer header when the "HTTP Referers" block is enabled. Recommendations: For PHP-Nuke versions 8.0 Final and earlier, consider disabling the "HTTP Referers" block until a patch is available to prevent exploitation. Restrict access to the `index.php` file to minimize the risk of SQL injection attacks. Avoid using the `HTTP REFERER` variable in sensitive SQL queries until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** PHP-Fusion versions 6.00.200 through 6.00.300 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can be exploited via the `sortby` parameter in the "members.php" endpoint and through IMG tags. **Recommendations** For PHP-Fusion versions 6.00.200 through 6.00.300, as a temporary workaround, consider restricting access to the `members.php` endpoint and avoiding the use of the `sortby` parameter until a patch is available. Additionally, restrict the use of IMG tags to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHP-Fusion versions 6.00.200 through 6.00.300 **Description** The issue allows remote attackers to execute arbitrary SQL commands via the `ratings` parameter in multiple scripts, such as "ratings include.php". This can lead to unauthorized access and manipulation of database content. **Recommendations** For PHP-Fusion versions 6.00.200 through 6.00.300, update to a version that includes a fix for this issue to prevent SQL injection attacks. As a temporary workaround, consider restricting access to the `ratings include.php` script and avoiding the use of the `ratings` parameter until a patch is available.

**Name of the Vulnerable Software and Affected Versions** jportal version 2.3.1 **Description** The issue allows remote attackers to execute arbitrary SQL commands via the search field to "download.php". This is a SQL injection vulnerability in the module/down.inc.php file. **Recommendations** For jportal version 2.3.1, consider restricting access to the vulnerable module until a patch is available. Avoid using the search field in the download.php endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.