PT-2005-3249 · Unknown · Clever Copy+1

Lostmon · Published 2005-07-19 · Updated 2008-09-05 · CVE-2005-2323

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Class-1 Forum versions 0.23.2 through 0.24.4 Clever Copy with forums installed (affected versions not specified)

Description The issue allows remote attackers to modify SQL statements. This can be achieved via the id parameter to "viewattach.php", the viewuser id parameter to "users.php", or the id or forum parameters to "viewforum.php".

Recommendations For Class-1 Forum versions 0.23.2 through 0.24.4, consider restricting access to the "viewattach.php", "users.php", and "viewforum.php" scripts until a patch is available. For Clever Copy with forums installed, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-2323

Affected Products

Class-1 Forum

Clever Copy

References · 9

• 🔥 http://securitytracker.com/id?1014485 · Exploit
• 🔥 http://securitytracker.com/id?1014486 · Exploit
• 🔥 http://lostmon.blogspot.com/2005/07/class-1-forum-software-cross-site.html · Exploit
• 🔥 https://exploit-db.com/exploits/1208 · Exploit
• http://secunia.com/advisories/16078 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2323 · Security Note
• http://osvdb.org/17923 · Note
• http://osvdb.org/17922 · Note
• http://osvdb.org/17921 · Note