PT-2009-4739 · Punbb · Punbb+1

Dante90 + 1 · Published 2009-07-02 · Updated 2017-09-19 · CVE-2009-2308

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PunBB Affiliation module versions 1.1.0 and earlier

Description The issue concerns SQL injection vulnerabilities in the affiliates.php file of the Affiliation module for PunBB. Remote attackers can execute arbitrary SQL commands by manipulating the in or out parameters.

Recommendations For PunBB Affiliation module versions 1.1.0 and earlier, consider restricting access to the affiliates.php file until a patch is available. As a temporary workaround, avoid using the in and out parameters in the affected module to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-2308

Affected Products

Punbb

Punbb Affiliation Module

References · 8

• 🔥 https://exploit-db.com/exploits/9055 · Exploit
• 🔥 http://packetstormsecurity.org/0906-exploits/punbbaffiliations-blindsql.txt · Exploit
• 🔥 http://packetstormsecurity.org/0906-exploits/punbbaffiliationsin-blindsql.txt · Exploit
• 🔥 http://exploit-db.com/exploits/9055 · Exploit
• http://secunia.com/advisories/35654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2308 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51437 · Note
• http://osvdb.org/55478 · Note