PT-2005-4615 · Joel · Joels Bulletin Board

Published 2005-11-29 · Updated 2011-03-08 · CVE-2005-3871

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Joels Bulletin board (JBB) versions 0.9.9rc3 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters in different PHP files, including the nr parameter in "topiczeigen.php", the forum and zeigeseite parameters in "showforum.php", the forum parameter in "newtopic.php", and the tidnr parameter in "neuerbeitrag.php".

Recommendations For Joels Bulletin board (JBB) versions 0.9.9rc3 and earlier, as a temporary workaround, consider restricting access to the vulnerable parameters nr, forum, zeigeseite, and tidnr in their respective PHP files until a patch is available. Avoid using these parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-3871

Affected Products

Joels Bulletin Board

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2005-3871 · Security Note
• http://secunia.com/advisories/17727 · Vendor Advisory
• http://osvdb.org/21148 · Note
• http://pridels0.blogspot.com/2005/11/jbb-sql-inj-vuln.html · Note
• http://securityfocus.com/bid/15590 · Note
• http://osvdb.org/21150 · Note
• http://osvdb.org/21149 · Note
• http://vupen.com/english/advisories/2005/2620 · Note
• http://osvdb.org/21151 · Note