PT-2012-2068 · Gr Board · Gboard

Published 2012-05-24 · Updated 2024-02-14 · CVE-2011-5090

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions GR Board (aka grboard) version 1.8.6.5 Community Edition

Description The issue allows remote attackers to modify or delete data without requiring authentication for certain database actions. This can be achieved by sending a request to specific API endpoints, including "mod rewrite.php", "comment write ok.php", "poll/index.php", "update/index.php", "trackback.php", or an arbitrary "poll.php" script under the "theme/" directory.

Recommendations For GR Board (aka grboard) version 1.8.6.5 Community Edition, consider restricting access to the mentioned API endpoints, such as "mod rewrite.php", "comment write ok.php", "poll/index.php", "update/index.php", "trackback.php", and arbitrary "poll.php" scripts under "theme/", until a proper fix is available. Additionally, implementing proper authentication mechanisms for database actions can help mitigate the risk of unauthorized data modification or deletion.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2011-5090

Affected Products

Gboard

References · 3

• 🔥 http://sirini.net/grboard/board.php?id=developer&articleNo=591 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5090 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75856 · Note