AdaptBB Multiple Input Validation Vulnerabilities
BID:34452
Info
AdaptBB Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 34452 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 09 2009 12:00AM |
| Updated: | Apr 09 2009 08:56PM |
| Credit: | Salvatore "drosophila" Fresta |
| Vulnerable: |
insanevisions AdaptBB 1.0 Beta |
| Not Vulnerable: | |
Discussion
AdaptBB Multiple Input Validation Vulnerabilities
AdaptBB is prone to multiple security vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues, an arbitrary-file-upload issue, and an arbitrary-command-execution issue.
Exploiting these issues can allow an attacker to upload and execute arbitrary files, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.
AdaptBB 1.0 Beta is vulnerable; other versions may also be affected.
AdaptBB is prone to multiple security vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues, an arbitrary-file-upload issue, and an arbitrary-command-execution issue.
Exploiting these issues can allow an attacker to upload and execute arbitrary files, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.
AdaptBB 1.0 Beta is vulnerable; other versions may also be affected.
Exploit / POC
AdaptBB Multiple Input Validation Vulnerabilities
An attacker can exploit these issues via a browser.
The following example URIs are available:
An attacker can exploit these issues via a browser.
The following example URIs are available:
Solution / Fix
AdaptBB Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].