PT-2005-1617 · Punbb · Punbb

John Gumbel · Published 2005-02-27 · Updated 2017-07-11 · CVE-2005-0569

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PunBB version 1.2.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including the language parameter to "register.php", the change email feature in "profile.php", or the posts or topics parameter to "moderate.php".

Recommendations For PunBB version 1.2.1, consider restricting access to the "register.php", "profile.php", and "moderate.php" scripts until a patch is available. As a temporary workaround, avoid using the language, posts, and topics parameters in the affected scripts.

Exploit

Fix

Related Identifiers

CVE-2005-0569

Affected Products

Punbb

References · 9

• 🔥 https://exploit-db.com/exploits/25160 · Exploit
• 🔥 http://securityfocus.com/bid/12652 · Exploit
• http://secunia.com/advisories/14538 · Vendor Advisory
• http://secunia.com/advisories/14394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0569 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0569 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19473 · Note
• http://punbb.org/changelogs/1.2.1_to_1.2.2.txt · Note
• http://marc.info/?l=bugtraq&m=110927754230666&w=2 · Note