PT-2005-2949 · Unknown · Ultimate Php Board

Alberto Trivero · Published 2005-06-16 · Updated 2016-10-18 · CVE-2005-2003

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ultimate PHP Board (UPB) version 1.9.6 GOLD

Description The issue allows remote attackers to obtain sensitive information by providing an invalid id parameter, set to zero, to specific API endpoints, including "viewtopic.php", "profile.php", or "newpost.php". This action reveals the path in an error message.

Recommendations For Ultimate PHP Board (UPB) version 1.9.6 GOLD, consider validating the id parameter to prevent the disclosure of sensitive information. As a temporary workaround, restrict access to the "viewtopic.php", "profile.php", and "newpost.php" endpoints to minimize the risk of exploitation. Avoid using the id parameter with a value of zero in these endpoints until the issue is resolved.

Fix

Related Identifiers

CVE-2005-2003

Affected Products

Ultimate Php Board

References · 3

• http://secunia.com/advisories/15732 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2003 · Security Note
• http://marc.info/?l=bugtraq&m=111893777504821&w=2 · Note