PHPBB Fetch All Common Script SQL Injection Vulnerability
BID:10893
Info
PHPBB Fetch All Common Script SQL Injection Vulnerability
| Bugtraq ID: | 10893 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 07 2004 12:00AM |
| Updated: | Aug 07 2004 12:00AM |
| Credit: | The discoverer of this vulnerability is unknown. |
| Vulnerable: |
Volker Rattel phpBB Fetch All 2.0.11 Volker Rattel phpBB Fetch All 2.0.10 |
| Not Vulnerable: |
Volker Rattel phpBB Fetch All 2.0.12 |
Discussion
PHPBB Fetch All Common Script SQL Injection Vulnerability
It is reported that phpBB Fetch All is susceptible to an SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input before using it in an SQL query.
The problem presents itself when malicious SQL statements are passed as a value for the 'forum_id' argument in the 'common.php' script. The script uses this argument without sanitization in an SQL query.
The successful exploitation of this vulnerability depends on the implementation of the web application that includes phpBB Fetch All as a component. It may or may not be possible to effectively pass malicious SQL statements to the underlying function.
Versions prior to 2.0.12 are reported to be affected.
It is reported that phpBB Fetch All is susceptible to an SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input before using it in an SQL query.
The problem presents itself when malicious SQL statements are passed as a value for the 'forum_id' argument in the 'common.php' script. The script uses this argument without sanitization in an SQL query.
The successful exploitation of this vulnerability depends on the implementation of the web application that includes phpBB Fetch All as a component. It may or may not be possible to effectively pass malicious SQL statements to the underlying function.
Versions prior to 2.0.12 are reported to be affected.
Exploit / POC
PHPBB Fetch All Common Script SQL Injection Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
PHPBB Fetch All Common Script SQL Injection Vulnerability
Solution:
It is reported that phpBB Fetch All 2.0.12 is not affected by this issue. This has not been confirmed at the moment.
Solution:
It is reported that phpBB Fetch All 2.0.12 is not affected by this issue. This has not been confirmed at the moment.
References
PHPBB Fetch All Common Script SQL Injection Vulnerability
References:
References:
- phpBB Fetch All Home Page (Volker Rattel)