PT-2008-4464 · Mxchange · Xchangeboard

Hazl0Oh · Published 2008-07-07 · Updated 2017-09-29 · CVE-2008-3035

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XchangeBoard versions 1.70 Final and earlier

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the boardID parameter in the "newThread.php" file.

Recommendations For XchangeBoard versions 1.70 Final and earlier, avoid using the boardID parameter in the newThread.php file until a fix is available. Consider restricting access to newThread.php to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-3035

Affected Products

Xchangeboard

References · 6

• 🔥 https://exploit-db.com/exploits/5991 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3035 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3035 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43529 · Note
• http://securityfocus.com/bid/30059 · Note
• http://secunia.com/advisories/30919 · Note