Info

Disclosure

Jun 21, 2005

Discovery

Apr 24, 2005

Dates

Exploit

Jun 21, 2005

Solution

Unknown

Description

Forum Russian Board (FRB) contains a flaw that may allow a remote attacker to carry out an SQL injection attack. The issue is due to the 'enter.php' script not properly sanitizing user-supplied input to the 'sid' and 'passw' variables. This may allow a remote attacker to inject or manipulate SQL queries in the backend database.

Classification

Location: Remote/Network Access Required
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Available
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

Gavrilov Dmitriy

Forum Russian Board (FRB)

4.2

References

Bugtraq ID: 14045
Secunia Advisory ID: 15787
Related OSVDB ID: 17484 17485 17486 17494 17495 17496 17497 17498 17499 17500 17501 17502 17503 17504 17505 17506
Other Advisory URL: http://rst.void.ru/papers/advisory29.txt
Vendor URL: http://www.carline.ru/

Credit

1dt.w0lf & foster - Personal Page

Direct URL: http://osvdb.org/36218