PT-2008-3547 · Minibb · Minibb

Girex · Published 2008-04-30 · Updated 2017-09-29 · CVE-2008-2028

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions miniBB versions 2.2 and earlier

Description The issue allows remote attackers to obtain the full path of the system via a direct request to the glang parameter in a registernew action to "index.php". This is possible when register globals is enabled, and it leaks the path in an error message.

Recommendations For miniBB versions 2.2 and earlier, consider disabling the register globals setting to prevent exploitation. As a temporary workaround, restrict access to the index.php file, specifically the registernew action, until a patch is available. Avoid using the glang parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-2028

Affected Products

Minibb

References · 6

• 🔥 https://exploit-db.com/exploits/5494 · Exploit
• http://minibb.net/forums/9_5110_0.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-2028 · Security Note
• http://secunia.com/advisories/29997 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42012 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2028 · Note