PT-2006-4659 · Deluxebb · Deluxebb

Jessica Hope + 1 · Published 2006-07-21 · Updated 2018-10-17 · CVE-2006-3799

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DeluxeBB versions 1.07 and earlier

Description The issue allows remote attackers to bypass SQL injection protection mechanisms. This can be achieved by using lowercase statements such as union select in the login variable and certain other variables, which do not match the uppercase UNION SELECT that the protection mechanisms are looking for.

Recommendations For DeluxeBB versions 1.07 and earlier, as a temporary workaround, consider restricting the use of the login variable and other vulnerable variables in SQL queries until a patch is available. Avoid using the union select statement in affected API endpoints, such as "/api/v1/login", until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-3799

Affected Products

Deluxebb

References · 8

• 🔥 http://securityfocus.com/bid/19052 · Exploit
• http://secunia.com/advisories/21116 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3799 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3799 · Note
• http://vupen.com/english/advisories/2006/2879 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047989.html · Note
• http://securityfocus.com/archive/1/440435/100/0/threaded · Note
• http://securityreason.com/securityalert/1254 · Note