PT-2011-4411 · Punbb · Punbb

Henri Salo · Published 2011-10-02 · Updated 2012-05-18 · CVE-2011-3371

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PunBB versions prior to 1.3.6

Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to different PHP files, including delete.php, edit.php, login.php, misc.php, profile.php, and register.php. The vulnerable parameters include id, form sent, csrf token, req confirm, delete, req message, submit, action, req email, request pass, email, redirect url, req subject, req old password, req new password1, req new password2, update, req username, req password1, req password2, req email1, timezone, and register.

Recommendations For PunBB versions prior to 1.3.6, update to version 1.3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable parameters until a patch is applied. Avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-3371

Affected Products

Punbb

References · 12

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2011-09/0272.html · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2011-09/0210.html · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2011-09/0193.html · Exploit
• https://github.com/punbb/punbb/commit/dd50a50a2760f10bd2d09814e30af4b36052ca6d · Patch
• ❌ https://github.com/downloads/punbb/punbb/punbb-1.3.6.zip · Patch, Deleted
• http://punbb.informer.com/forums/topic/24430/punbb-136 · Patch
• http://punbb.informer.com/forums/topic/24427/multiple-xss-vulnerabilities · Patch
• http://openwall.com/lists/oss-security/2011/09/22/3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-3371 · Security Note
• http://openwall.com/lists/oss-security/2011/09/18/1 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3371 · Note
• http://securitytracker.com/id?1026073 · Note