WowBB Forum Multiple Unspecified Remote Input Validation Vulnerabilities

Bugtraq ID:	11429
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 15 2004 12:00AM
Updated:	Oct 16 2006 07:24PM
Credit:	The individual or individuals responsible for disclosure of these issues are currently unknown; these issues were disclosed by Positive Technologies.
Vulnerable:	WowBB Web Forum 1.62 WowBB Web Forum 1.61 WowBB Web Forum 1.6 WowBB Web Forum
Not Vulnerable:	WowBB Web Forum 1.7

WowBB Forum Multiple Unspecified Remote Input Validation Vulnerabilities

WowBB is reportedly affected by multiple-input validation vulnerabilities because the application fails to properly sanitize user-supplied input gbefore including it in dynamic web content and SQL database queries.

An attacker can leverage these issues to manipulate or reveal database contents through SQL-injection attacks and may carry out other attacks and steal cookie-based authentication credentials through cross-site scripting attacks.

WowBB Forum Multiple Unspecified Remote Input Validation Vulnerabilities

An exploit is not required.

WowBB Forum Multiple Unspecified Remote Input Validation Vulnerabilities

Solution:
The vendor has released version 1.7 to address these issues. Please contact the vendor for details on obtaining the appropriate updates.

WowBB Forum Multiple Unspecified Remote Input Validation Vulnerabilities

References:

• Advisories (MaxPatrol)
  
• WowBB Home Page (WowBB)