OpenBB Multiple SQL Injection Vulnerabilities

Bugtraq ID:	14494
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 08 2005 12:00AM
Updated:	Aug 08 2005 12:00AM
Credit:	[email protected] is credited with the discovery of this vulnerability.
Vulnerable:	OpenBB OpenBB 1.1 .0
Not Vulnerable:

OpenBB Multiple SQL Injection Vulnerabilities

OpenBB is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

The consequences of these attacks may vary depending on the type of queries that can be influenced, and the implementation of the database.

OpenBB Multiple SQL Injection Vulnerabilities

No exploit is required.

Examples have been provided:

http://www.example.com/openbb/board.php?FID=[sql]
http://www.example.com/openbb/read.php?TID=[sql]
http://www.example.com/openbb/member.php?action=profile&UID=[sql]

OpenBB Multiple SQL Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

OpenBB Multiple SQL Injection Vulnerabilities

References:

• OpenBB Homepage (OpenBB)
  
• SQL IN Open Bulletin Board ([email protected])