PT-2014-8881 · Pbboard · Pbboard

Published 2014-12-05 · Updated 2018-10-09 · CVE-2014-9215

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PBBoard version 3.0.1 before 20141128

Description A SQL injection issue exists in the CheckEmail function, allowing remote attackers to execute arbitrary SQL commands via the email parameter in the register page to "index.php".

Recommendations For PBBoard version 3.0.1 before 20141128, consider updating to a version released after 20141128 to resolve the issue. As a temporary workaround, restrict access to the register page or avoid using the email parameter in the "index.php" endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-9215

Affected Products

Pbboard

References · 5

• 🔥 https://exploit-db.com/exploits/35473 · Exploit
• 🔥 https://youtube.com/watch?v=AQiGvH5xrJg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9215 · Security Note
• http://itas.vn/news/ITAS-Team-discovered-SQL-Injection-in-PBBoard-CMS-68.html · Note
• http://securityfocus.com/archive/1/534149/100/0/threaded · Note