PT-2008-5669 · Icebb · Icebb

Published 2008-10-03 · Updated 2017-08-08 · CVE-2008-4431

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: IceBB versions 1.0-rc9.3 and earlier

Description: The issue is related to a SQL injection vulnerability. It allows remote attackers to execute arbitrary SQL commands via the skin parameter. This is likely due to an incorrect protection mechanism in the clean string function.

Recommendations: For IceBB versions 1.0-rc9.3 and earlier, consider restricting access to the skin parameter in the index.php file until a patch is available. As a temporary workaround, review and modify the clean string function in includes/functions.php to properly protect against SQL injection attacks.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-4431

Affected Products

Icebb

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2008-4431 · Security Note
• http://secunia.com/advisories/31439 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44403 · Note
• http://securityfocus.com/bid/30656 · Note
• http://forums.xaos-ia.com/?topic=765 · Note