NextBBS Multiple Input Validation Security Vulnerabilities

Bugtraq ID:	52728
Class:	Input Validation Error
CVE:	CVE-2012-1602 CVE-2012-1603 CVE-2012-1604
Remote:	Yes
Local:	No
Published:	Mar 27 2012 12:00AM
Updated:	Oct 03 2012 03:40PM
Credit:	Janek Vind "waraxe"
Vulnerable:	NextBBS NextBBS 0.6
Not Vulnerable:

NextBBS Multiple Input Validation Security Vulnerabilities

NextBBS is prone to multiple SQL-injection vulnerabilities, a cross-site scripting vulnerability, and an authentication-bypass vulnerability.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and bypass the authentication process to gain unauthorized access to the system.

NextBBS 0.6.0 is vulnerable; other versions may also be affected.

NextBBS Multiple Input Validation Security Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NextBBS Multiple Input Validation Security Vulnerabilities

References:

• NextBBS Homepage (NextBBS)
  
• [waraxe-2012-SA#080] - Multiple Vulnerabilities in NextBBS 0.6.0 (Janek Vind)