PT-2003-2222 · Yabb · Yabb

Published 2003-12-31 · Updated 2008-09-05 · CVE-2003-1277

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Yet Another Bulletin Board (YaBB) version 1.5.0

Description The issue allows remote attackers to execute arbitrary script as other users, potentially stealing authentication information via cookies. This is achieved by injecting arbitrary HTML or script into specific parameters, including news icon of news template.php and threadid and subject of index.html.

Recommendations For Yet Another Bulletin Board (YaBB) version 1.5.0, consider restricting access to the news template.php and index.html files until a patch is available. As a temporary workaround, avoid using the news icon, threadid, and subject parameters in the affected files to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2003-1277

Affected Products

Yabb

References · 5

• 🔥 http://securiteam.com/unixfocus/5BP051F8VE.html · Exploit
• 🔥 http://securiteam.com/unixfocus/5BP061F8US.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1277 · Security Note
• http://iss.net/security_center/static/10989.php · Note
• http://iss.net/security_center/static/10990.php · Note