UBBCentral UBB.threads Dosearch.PHP SQL Injection Vulnerability

Bugtraq ID:	11502
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 21 2004 12:00AM
Updated:	Oct 21 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to "Florian Rock" <[email protected]>.
Vulnerable:	UBBCentral UBB.threads 3.5 UBBCentral UBB.threads 3.4
Not Vulnerable:

UBBCentral UBB.threads Dosearch.PHP SQL Injection Vulnerability

It is reported that UBBCentral UBB.threads is prone to an SQL injection vulnerability. This issue is due to a failure of the application to properly validate user supplied URI input.

Because of this, a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database.

UBBCentral UBB.threads Dosearch.PHP SQL Injection Vulnerability

The following example is available:

www.example.com/dosearch.php?Name=' OR U_Password='db5c82346d770f48bdd8929094c0c695
OR
www.example.com/dosearch.php?Name=' OR U_Password='db5c82346d770f48bdd8929094c0c695'/*

UBBCentral UBB.threads Dosearch.PHP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

UBBCentral UBB.threads Dosearch.PHP SQL Injection Vulnerability

References:

• UBB.threads Homepage (UBBCentral)
  
• SQL Injection in UBB.threads 3.4.x ("Florian Rock" )