DeluxeBB Multiple Input Validation Vulnerabilities

Bugtraq ID:	19052
Class:	Input Validation Error
CVE:	CVE-2006-3795 CVE-2006-3797 CVE-2006-3799
Remote:	Yes
Local:	No
Published:	Jul 18 2006 12:00AM
Updated:	Jul 06 2016 01:33PM
Credit:	Jessica Hope and Th3 M0ths are credited with the discovery of these vulnerabilities.
Vulnerable:	DeluxeBB DeluxeBB 1.07
Not Vulnerable:	DeluxeBB DeluxeBB 1.08

DeluxeBB Multiple Input Validation Vulnerabilities

DeluxeBB is prone to a cross-site scripting issue and an SQL-injection issue because the application fails to properly sanitize user-supplied input.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

DeluxeBB Multiple Input Validation Vulnerabilities

Attackers can exploit these issues through a web client.

• /data/vulnerabilities/exploits/deluxebb-jul18-2006.txt

DeluxeBB Multiple Input Validation Vulnerabilities

Solution:
The vendor has released version 1.08 to address these issues. Please see the references for details.

DeluxeBB Multiple Input Validation Vulnerabilities

References:

• BlogHoster Homepage (BlogHoster)
  
• DeluxeBB mutiple vulnerabilities (Jessica Hope)