XMB Forum Multiple Input Validation Vulnerabilities

Bugtraq ID:	16604
Class:	Input Validation Error
CVE:	CVE-2006-0778 CVE-2006-0779
Remote:	Yes
Local:	No
Published:	Feb 13 2006 12:00AM
Updated:	Sep 10 2008 09:20PM
Credit:	James Bercegay of the GulfTech Security Research Team is credited with the discovery of these vulnerabilities.
Vulnerable:	XMB Forum 1.9.3 XMB Forum 1.9.2 XMB Forum 1.9.1 XMB Forum 1.9 beta XMB Forum 1.9 XMB Forum 1.8 SP3 XMB Forum 1.8 SP2 XMB Forum 1.8 SP1 XMB Forum 1.8
Not Vulnerable:	XMB Forum 1.9.8

XMB Forum Multiple Input Validation Vulnerabilities

XMB Forum is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input.

Successful exploits of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or exploit vulnerabilities in the underlying database. Other attacks are also possible.

XMB Forum Multiple Input Validation Vulnerabilities

An exploit is not required.

The following proof-of-concept URI is available for the cross-site scripting issue:

http://www.example.com/u2u.php?action=send&username=%22%3E%3Ciframe%3E

XMB Forum Multiple Input Validation Vulnerabilities

Solution:
A vendor update is available. Contact the vendor for more information.

XMB Forum Multiple Input Validation Vulnerabilities

References:

• XMB Forums Multiple Vulnerabilities (GulfTech)
  
• Summary of Official Vendor Statements (XMB)
  
• XMB Forum Home Page (The XMB Group)