PT-2012-5160 · Pbboard · Pbboard

Published 2012-08-12 · Updated 2024-02-14 · CVE-2012-4035

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PBBoard version 2.1.4

Description The issue allows remote attackers to change the password of arbitrary user accounts. This is achieved by exploiting the new password page, specifically through the member id and new password parameters to the "index.php" endpoint.

Recommendations For PBBoard version 2.1.4, consider restricting access to the new password page until a fix is available, and avoid using the member id and new password parameters in the "index.php" endpoint to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-4035

Affected Products

Pbboard

References · 9

• 🔥 http://securityfocus.com/bid/54916 · Exploit
• 🔥 https://exploit-db.com/exploits/37615 · Exploit
• 🔥 https://htbridge.com/advisory/HTB23101 · Exploit
• http://pbboard.com/forums/t10353.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4035 · Security Note
• http://secunia.com/advisories/50153 · Vendor Advisory
• http://osvdb.org/84481 · Note
• http://pbboard.com/forums/t10352.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77506 · Note