PT-2006-3982 · Apboard · Apboard

666 · Published 2006-06-19 · Updated 2018-10-18 · CVE-2006-3078

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions APBoard versions 2.2-r3 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the PHPSESSID parameter in "board.php" and the viewcatmod parameter in "main.php".

Recommendations For APBoard versions 2.2-r3 and earlier, consider restricting access to the board.php and main.php files until a patch is available. As a temporary workaround, avoid using the PHPSESSID and viewcatmod parameters in the affected API endpoints.

Fix

Related Identifiers

CVE-2006-3078

Affected Products

Apboard

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2006-3078 · Security Note
• http://secunia.com/advisories/20682 · Vendor Advisory
• http://osvdb.org/26582 · Note
• http://securityreason.com/securityalert/1117 · Note
• http://vupen.com/english/advisories/2006/2401 · Note
• http://securityfocus.com/archive/1/437271/100/0/threaded · Note
• http://securityfocus.com/bid/18447 · Note
• http://osvdb.org/26583 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27163 · Note