PT-2005-3460 · Funkboard · Funkboard

Retrogod · Published 2005-08-16 · Updated 2016-10-18 · CVE-2005-2569

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FunkBoard versions 0.66CF and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via certain parameters to various PHP files. This can be achieved by manipulating the fbusername or fbpassword parameter in files such as editpost.php, prefs.php, newtopic.php, reply.php, or profile.php. Additionally, multiple parameters in register.php, including fbusername, fmail, www, icq, yim, location, sex, interебbies, sig, and aim, are vulnerable, as well as the subject parameter in newtopic.php.

Recommendations For FunkBoard versions 0.66CF and earlier, consider disabling the affected parameters, such as fbusername, fbpassword, fmail, www, icq, yim, location, sex, interебbies, sig, aim, and subject, in the respective PHP files until a patch is available. Restrict access to the vulnerable PHP files, including editpost.php, prefs.php, newtopic.php, reply.php, profile.php, and register.php, to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-2569

Affected Products

Funkboard

References · 9

• 🔥 https://exploit-db.com/exploits/26118 · Exploit
• 🔥 https://exploit-db.com/exploits/26121 · Exploit
• 🔥 https://exploit-db.com/exploits/26117 · Exploit
• 🔥 https://exploit-db.com/exploits/26120 · Exploit
• 🔥 https://exploit-db.com/exploits/26122 · Exploit
• 🔥 https://exploit-db.com/exploits/26119 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2569 · Security Note
• http://marc.info/?l=bugtraq&m=112413891603018&w=2 · Note
• http://marc.info/?l=bugtraq&m=112360702307424&w=2 · Note