PunBB Multiple SQL Injection Vulnerabilities

Bugtraq ID:	14806
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 12 2005 12:00AM
Updated:	Sep 12 2005 12:00AM
Credit:	Smartys is credited with the discovery of this vulnerability.
Vulnerable:	PunBB PunBB 1.2.6 PunBB PunBB 1.2.5 PunBB PunBB 1.2.4 PunBB PunBB 1.2.3 PunBB PunBB 1.2.2 PunBB PunBB 1.2.1 PunBB PunBB 1.1.5 PunBB PunBB 1.1.4 PunBB PunBB 1.1.3 PunBB PunBB 1.1.2 PunBB PunBB 1.1.1 PunBB PunBB 1.1 PunBB PunBB 1.0.1 PunBB PunBB 1.0 RC2 PunBB PunBB 1.0 RC1 PunBB PunBB 1.0 _beta3 PunBB PunBB 1.0 _beta2 PunBB PunBB 1.0 _beta1 PunBB PunBB 1.0 _alpha PunBB PunBB 1.0
Not Vulnerable:	PunBB PunBB 1.2.7

PunBB Multiple SQL Injection Vulnerabilities

PunBB is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

PunBB Multiple SQL Injection Vulnerabilities

No exploit is required.

PunBB Multiple SQL Injection Vulnerabilities

Solution:
The vendor has released version 1.2.7 to address this issue:


PunBB PunBB 1.2.6

• PunBB punbb-1.2.7.tar.gz
  http://www.punbb.org/download/punbb-1.2.7.tar.gz

PunBB Multiple SQL Injection Vulnerabilities

References:

• PunBB Changelog (PunBB)
  
• PunBB Homepage (PunBB)