PT-2003-1863 · Ikonboard · Ikonboard

Published 2003-09-12 · Updated 2016-10-18 · CVE-2003-0770

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: IkonBoard versions 3.1.2a and earlier, including 3.1.1

Description: The issue arises from improper cleansing of the lang cookie in FUNC.pm when it contains illegal characters. This allows remote attackers to execute arbitrary code when the cookie is inserted into a Perl eval statement.

Recommendations: For IkonBoard versions 3.1.2a and earlier, including 3.1.1, consider implementing proper input validation and sanitization for the lang cookie to prevent the insertion of illegal characters. As a temporary workaround, restrict access to the FUNC.pm module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2003-0770

Affected Products

Ikonboard

References · 7

• 🔥 http://securityfocus.com/archive/1/317234 · Exploit
• 🔥 https://exploit-db.com/exploits/22499 · Exploit
• 🔥 https://exploit-db.com/exploits/22500 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-0770 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0770 · Note
• http://marc.info/?l=bugtraq&m=106381136115972&w=2 · Note
• http://securityfocus.com/archive/1/336598 · Note