PT-2009-1575 · Unknown · Discussion Forums 2K

~!Dok_Tor!~ · Published 2009-02-10 · Updated 2017-09-29 · CVE-2008-6100

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Discussion Forums 2k version 3.3

Description The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities. This is possible when the magic quotes gpc setting is disabled. The vulnerabilities can be exploited through specific parameters in various PHP files, including the CatID parameter in "RSS1.php" and "RSS2.php" and the SubID parameter in "RSS5.php".

Recommendations For Discussion Forums 2k version 3.3, consider disabling the magic quotes gpc setting to prevent SQL injection attacks. Additionally, as a temporary workaround, restrict access to the vulnerable parameters CatID and SubID in the affected PHP files until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-6100

Affected Products

Discussion Forums 2K

References · 4

• 🔥 http://securityfocus.com/bid/31518 · Exploit
• 🔥 https://exploit-db.com/exploits/6643 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6100 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45610 · Note