PT-2011-2346 · Tinybb · Tinybb

Aodrulez · Published 2011-01-12 · Updated 2024-02-14 · CVE-2011-0443

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions tinyBB version 1.2

Description The issue allows remote attackers to execute arbitrary SQL commands when magic quotes gpc is disabled. This can be achieved via the id parameter in a profile action to "index.php".

Recommendations For tinyBB version 1.2, consider disabling the profile action to index.php or restricting access to the id parameter until a patch is available. Additionally, enabling magic quotes gpc can help mitigate the risk of exploitation.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2011-0443

Affected Products

Tinybb

References · 10

• 🔥 http://securitytracker.com/id?1024949 · Exploit
• 🔥 http://exploit-db.com/exploits/15961 · Exploit
• 🔥 http://securityfocus.com/bid/45737 · Exploit
• 🔥 https://exploit-db.com/exploits/15961 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-0443 · Security Note
• http://secunia.com/advisories/42854 · Vendor Advisory
• http://tinybb.net/forum/?page=thread&post=989525101 · Note
• http://osvdb.org/70394 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0443 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64570 · Note