PT-2004-2463 · Broadboard · Broadboard Instant Asp Message Board

Pigrelax · Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1555

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BroadBoard Instant ASP Message Board (affected versions not specified)

Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary SQL commands through specific parameters in various ASP files. The affected parameters include the keywords parameter to "search.asp", the handle parameter to "profile.asp", the txtUserHandle parameter to "reg2.asp", and the txtUserEmail parameter to "forgot.asp".

Recommendations For BroadBoard Instant ASP Message Board, consider restricting access to the affected ASP files until a fix is available. As a temporary workaround, avoid using the keywords parameter in "search.asp", the handle parameter in "profile.asp", the txtUserHandle parameter in "reg2.asp", and the txtUserEmail parameter in "forgot.asp" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-1555

Affected Products

Broadboard Instant Asp Message Board

References · 11

• 🔥 https://exploit-db.com/exploits/24626 · Exploit
• 🔥 https://exploit-db.com/exploits/24625 · Exploit
• 🔥 http://securityfocus.com/bid/11250 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1555 · Security Note
• http://secunia.com/advisories/12658 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17501 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17502 · Note
• http://securitytracker.com/id?1011419 · Note
• http://marc.info/?l=bugtraq&m=109630777608244&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17498 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17500 · Note