PT-2005-3000 · Infopop · Ubb.Threads

Published 2005-06-28 · Updated 2016-10-18 · CVE-2005-2058

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Infopop UBB.Threads versions prior to 6.5.2 Beta

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via various parameters to different API endpoints, such as the Number parameter to "download.php", "modifypost.php", "mailthread.php", or "notifymod.php", the month or year parameter to "calendar.php", the message parameter to "viewmessage.php", the main parameter to "addfav.php", or the posted parameter to "grabnext.php".

Recommendations: For Infopop UBB.Threads versions prior to 6.5.2 Beta, update to version 6.5.2 Beta or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is available. Avoid using the vulnerable parameters, such as Number, month, year, message, main, and posted, in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-2058

Affected Products

Ubb.Threads

References · 12

• 🔥 https://exploit-db.com/exploits/25903 · Exploit
• 🔥 https://exploit-db.com/exploits/25901 · Exploit
• 🔥 https://exploit-db.com/exploits/25900 · Exploit
• 🔥 http://gulftech.org/?node=research&article_id=00084-06232005 · Exploit
• 🔥 https://exploit-db.com/exploits/25898 · Exploit
• 🔥 https://exploit-db.com/exploits/1069 · Exploit
• 🔥 https://exploit-db.com/exploits/25899 · Exploit
• 🔥 https://exploit-db.com/exploits/25902 · Exploit
• 🔥 https://exploit-db.com/exploits/25897 · Exploit
• http://ubbcentral.com/boards/showflat.php/Cat/0/Number/42351/Main/42351/#Post42351 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-2058 · Security Note
• http://marc.info/?l=bugtraq&m=111963737202040&w=2 · Note