PT-2004-1477 · Xmb Forum · Xmb

Janek Vind + 1 · Published 2004-03-18 · Updated 2021-04-29 · CVE-2004-0323

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XMB versions 1.8 Final SP2 through 1.9 beta

Description The issue allows remote attackers to inject arbitrary SQL and gain privileges. This can be achieved via several parameters in different PHP files, including the ppp parameter in "viewthread.php", the desc parameter in "misc.php", the tpp parameter in "forumdisplay.php", the ascdesc parameter in "forumdisplay.php", or the addon parameter in "stats.php".

Recommendations For XMB version 1.8 Final SP2, consider disabling the SQL injection prone parameters ppp, desc, tpp, ascdesc, and addon in their respective PHP files until a patch is available. For XMB version 1.9 beta, restrict access to the tpp parameter in "forumdisplay.php" to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-0323

Affected Products

Xmb

References · 9

• 🔥 http://securityfocus.com/bid/9726 · Exploit
• 🔥 https://exploit-db.com/exploits/23748 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0323 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15295 · Note
• http://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html · Note
• http://xmbforum.com/community/boards/viewthread.php?tid=746859 · Note
• https://docs.xmbforum2.com/index.php?title=Security_Issue_History · Note
• http://marc.info/?l=bugtraq&m=107756526625179&w=2 · Note
• http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.html · Note