Advanced Electron Forum Multiple Vulnerabilities

Bugtraq ID:	43565
Class:	Input Validation Error
CVE:	CVE-2009-2545 CVE-2009-2546
Remote:	Yes
Local:	No
Published:	Jul 16 2009 12:00AM
Updated:	Jul 16 2009 12:00AM
Credit:	Stefano Angaran
Vulnerable:	Electron Advanced Electron Forum 1.0.8 Electron Advanced Electron Forum 1.0.6 Electron Advanced Electron Forum 1.0.5 Electron Advanced Electron Forum 1.0.4 Electron Advanced Electron Forum 1.0.3 Electron Advanced Electron Forum 1.0.2 Electron Advanced Electron Forum 1.0.1
Not Vulnerable:

Advanced Electron Forum Multiple Vulnerabilities

Advanced Electron Forum is prone to information-disclosure and SQL-injection vulnerabilities.

Exploiting the information-disclosure issue may allow an attacker to obtain potentially sensitive information. The attacker can exploit the SQL-injection issues to carry out unauthorized actions on the underlying database, which may compromise the application and may aid in further attacks.

Advanced Electron Forum 1.0.8 is vulnerable; other versions may also be affected.

Advanced Electron Forum Multiple Vulnerabilities

Attackers can exploit the issues via a browser.

Advanced Electron Forum Multiple Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Advanced Electron Forum Multiple Vulnerabilities

References:

• Advanced Electron Forum Homepage (Electron)