PT-2006-2634 · Awebbb · Awebbb

Aliaksandr Hartsuyeu · Published 2006-04-06 · Updated 2018-10-18 · CVE-2006-1638

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: aWebBB version 1.2

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including the Username parameter to various PHP files such as 'accounts.php', 'changep.php', 'editac.php', 'feedback.php', 'fpass.php', 'login.php', 'post.php', 'reply.php', or 'reply log.php'. Additionally, the p parameter to 'dpost.php', the c parameter to 'list.php' or 'ndis.php', and the q parameter to 'search.php' are also vulnerable.

Recommendations: For aWebBB version 1.2, as a temporary workaround, consider restricting access to the vulnerable API endpoints, such as 'accounts.php', 'changep.php', 'editac.php', 'feedback.php', 'fpass.php', 'login.php', 'post.php', 'reply.php', 'reply log.php', 'dpost.php', 'list.php', 'ndis.php', and 'search.php', until a patch is available. Avoid using the Username, p, c, and q parameters in the affected endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2006-1638

Affected Products

Awebbb

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2006-1638 · Security Note
• http://secunia.com/advisories/19486 · Vendor Advisory
• http://osvdb.org/24347 · Note
• http://osvdb.org/24351 · Note
• http://osvdb.org/24346 · Note
• http://securityfocus.com/bid/17352 · Note
• http://osvdb.org/24348 · Note
• http://osvdb.org/24341 · Note
• http://securityfocus.com/archive/1/431064/100/0/threaded · Note
• http://osvdb.org/24344 · Note
• http://vupen.com/english/advisories/2006/1197 · Note
• http://osvdb.org/24343 · Note
• http://osvdb.org/24349 · Note
• http://evuln.com/vulns/117/summary.html · Note
• http://osvdb.org/24350 · Note