Beehive Forum Index.PHP SQL Injection Vulnerability

Bugtraq ID:	16521
Class:	Input Validation Error
CVE:	CVE-2005-4461
Remote:	Yes
Local:	No
Published:	Dec 22 2005 12:00AM
Updated:	Aug 24 2006 07:24PM
Credit:	trueend5 is credited with the discovery of this vulnerability.
Vulnerable:	Beehive Forum Beehive Forum 0.6.2
Not Vulnerable:

Beehive Forum Index.PHP SQL Injection Vulnerability

Beehive Forum is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation can allow an attacker to bypass authentication and gain administrative access to a site. Other attacks may also be possible.

Beehive Forum 0.6.2 is reported to be vulnerable.

Beehive Forum Index.PHP SQL Injection Vulnerability


An exploit is not required.

The following proof of concept examples are available:

http://www.example.com/beehive/index.php?user_sess=k
http://www.example.com/beehive/index.php?user_sess=1+MYFORUM

Beehive Forum Index.PHP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Beehive Forum Index.PHP SQL Injection Vulnerability

References:

• Open Classifieds Multiple Vulnerabilities (Moudi)