PT-2006-5770 · Php+2 · Php+2

Published 2006-09-27 · Updated 2018-10-17 · CVE-2006-5029

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WoltLab Burning Board (wBB) versions 2.3.x

Description A SQL injection issue in the thread.php file of WoltLab Burning Board (wBB) allows remote attackers to obtain version numbers of PHP, MySQL, and wBB by manipulating the page parameter. This issue might be related to a forced SQL error.

Recommendations For WoltLab Burning Board (wBB) versions 2.3.x, update to a version where this issue is resolved, if available. As a temporary workaround, consider restricting access to the thread.php file to minimize the risk of exploitation. Avoid using the page parameter in the affected thread.php file until the issue is resolved.

Fix

Related Identifiers

CVE-2006-5029

Affected Products

Mysql Server

Php

Woltlab Burning Board

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-5029 · Security Note
• http://securityfocus.com/archive/1/447069/100/100/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5029 · Note
• http://securityfocus.com/archive/1/446743/100/0/threaded · Note
• http://securityfocus.com/archive/1/446937/100/0/threaded · Note
• http://securityfocus.com/archive/1/446938/100/100/threaded · Note