PT-2005-4072 · Unknown · Versatilebulletinboard

Rgod · Published 2005-10-20 · Updated 2016-10-18 · CVE-2005-3259

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions versatileBulletinBoard (vBB) version 1.0.0 RC2

Description The issue allows remote attackers to execute arbitrary SQL commands and bypass authentication. This can be achieved through various features, including the login field, "search this thread" feature, "search for posts" feature, "forgot password" feature, and specific parameters in userlistpre.php and index.php, such as the list parameter, and the select, categ, and to parameters.

Recommendations For version 1.0.0 RC2, consider disabling the vulnerable features, including the login field, "search this thread" feature, "search for posts" feature, "forgot password" feature, and restrict access to the list parameter in userlistpre.php and the select, categ, and to parameters in index.php until a patch is available. Avoid using these parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-3259

Affected Products

Versatilebulletinboard

References · 13

• 🔥 https://exploit-db.com/exploits/1245 · Exploit
• 🔥 http://rgod.altervista.org/versatile100RC2.html · Exploit
• 🔥 http://securityfocus.com/bid/15068 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-3259 · Security Note
• http://secunia.com/advisories/17174 · Vendor Advisory
• http://osvdb.org/19968 · Note
• http://osvdb.org/19962 · Note
• http://osvdb.org/19965 · Note
• http://osvdb.org/19963 · Note
• http://osvdb.org/19967 · Note
• http://osvdb.org/19966 · Note
• http://marc.info/?l=bugtraq&m=112907535528616&w=2 · Note
• http://osvdb.org/19964 · Note