CVE-2005-0569 - Multiple SQL injection vulnerabilities in PunBB 1.2.1 allow remote attackers to execute arbitrary SQ

CVE-2005-0569

Summary

Multiple SQL injection vulnerabilities in PunBB 1.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) language parameter to register.php, (2) change email feature in profile.php, (3) posts or (4) topics parameter to moderate.php.

References

http://marc.info/?l=bugtraq&m=110927754230666&w=2
http://secunia.com/advisories/14394
http://secunia.com/advisories/14538
http://www.punbb.org/changelogs/1.2.1_to_1.2.2.txt
http://www.securityfocus.com/bid/12652
https://exchange.xforce.ibmcloud.com/vulnerabilities/19473

Vulnerable Configurations

cpe:2.3:a:punbb:punbb:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:punbb:punbb:1.2.1:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 11-07-2017 - 01:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	12652
bugtraq	20050224 Multiple vulns in punBB
confirm	http://www.punbb.org/changelogs/1.2.1_to_1.2.2.txt
secunia	14394 14538
xf	punbb-multiple-sql-injection(19473)

Last major update

11-07-2017 - 01:32

Published

02-05-2005 - 04:00

Last modified

11-07-2017 - 01:32