PT-2008-6551 · Punbb · Punbb

Phplizardo · Published 2008-12-11 · Updated 2017-08-08 · CVE-2008-5434

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PunBB versions 1.3 through 1.3.1

Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This can be achieved via the order by or direction parameter to "admin/users.php", or through configuration options to "admin/settings.php".

Recommendations For PunBB versions 1.3 through 1.3.1, consider restricting access to the admin/users.php and admin/settings.php pages until a fix is available. As a temporary workaround, avoid using the order by and direction parameters in the admin/users.php page, and limit modifications to configuration options in admin/settings.php.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-5434

Affected Products

Punbb

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2008-5434 · Security Note
• http://punbb.informer.com · Vendor Advisory
• http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_in_adminsettings.php_via_configuration_values · Vendor Advisory
• http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_at_adminusers.php_page · Vendor Advisory
• http://punbb.informer.com/forums/topic/20475/punbb-132 · Note
• http://openwall.com/lists/oss-security/2008/12/09/3 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47185 · Note
• http://secunia.com/advisories/33059 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5434 · Note