OSVDB ID: 12593

Title: vBulletin Last XX Posts last10.php ftitle Parameter SQL Injection

Info

Disclosure
Dec 22, 2004

Discovery
Unknown

Dates

Exploit
Dec 22, 2004

Solution
Unknown

Description

 vBulletin Last XX Posts contains a flaw that will allow a remote attacker to inject arbitrary SQL code. The problem is that the 'ftitle' parameter in the 'last10.php' script is not verified properly and will allow an attacker to inject or manipulate SQL queries.

Classification

 Location: Remote/Network Access Required
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

 Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

Kevin

Last XX Posts

 1.0.2
1.0.1
1.0.0
0.x

References

Credit
  • al3ndaleeb - al3ndaleebBrand New Doo Doouk2.net -


Direct URL: http://osvdb.org/36218