|
|
Info |
Last Modified |
| 6 months ago |
|
|
|
|
Description |
OpenBB contains a flaw that allows remote attackers to execute arbitrary OpenBB commands. The issue is due to the bulletin board not properly utilizing session IDs or authentication tokens. If an attacker supplies a malicious command embedded in an image tag which is posted or sent as a private message, the command will be executed without confirmation by the administrator.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity,
Loss of Availability
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
OSVDB:
Web Related
|
|
Solution |
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.
|
|
Products |
|
Open Bulletin Board
 |
1.0.2 |
1.0.3 |
1.0.4 |
1.0.5 |
1.0.6 |
1.0.1 |
|
|
|
|
|
Credit |
- JeiAr - jeiar
 gulftech.org - GulfTech Security Research Team
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
