PT-2005-1694 · Projectbb · Projectbb

Benjilenoob · Published 2005-03-04 · Updated 2017-07-11 · CVE-2005-0651

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ProjectBB version 0.4.5.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via various parameters and fields, including liste or desc parameters to "divers.php", the search feature text area, post name in the post creation feature, City, Homepage, ICQ, AOL, Yahoo!, MSN, or e-mail fields in the profile feature, and the new field in the moderator section.

Recommendations For ProjectBB version 0.4.5.1, as a temporary workaround, consider restricting access to the "divers.php" endpoint and limiting user input in the search feature, post creation, profile, and moderator sections to minimize the risk of exploitation. Avoid using the liste and desc parameters in the "divers.php" endpoint until the issue is resolved. Additionally, restrict user input in the City, Homepage, ICQ, AOL, Yahoo!, MSN, e-mail, and new fields. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2005-0651

Affected Products

Projectbb

References · 7

• 🔥 http://securityfocus.com/bid/12710 · Exploit
• 🔥 http://securitytracker.com/id?1013332 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-0651 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19557 · Note
• http://secunia.com/advisories/14533 · Note
• http://vupen.com/english/advisories/2005/0223 · Note
• http://marc.info/?l=bugtraq&m=111031893610270&w=2 · Note