Ilia Alshanetsky FUDForum SQL Injection Vulnerability

Bugtraq ID:	5500
Class:	Input Validation Error
CVE:	CVE-2002-1421
Remote:	Yes
Local:	No
Published:	Aug 19 2002 12:00AM
Updated:	Jul 11 2009 03:56PM
Credit:	Discovery credited to Ulf Harnhammar <[email protected]>.
Vulnerable:	Ilia Alshanetsky FUDForum 2.0.2 Ilia Alshanetsky FUDForum 1.9.8 Ilia Alshanetsky FUDForum 1.2.8
Not Vulnerable:	Ilia Alshanetsky FUDForum 2.2.3 Ilia Alshanetsky FUDForum 2.2 .0

Ilia Alshanetsky FUDForum SQL Injection Vulnerability

Ilia Alshanetsky FUDForum is a freely available Web-based forum.

Reportedly, L-Forum is vulnerable to SQL injection attacks. SQL code may be inserted into the requests and executed by the database server. These requests could include adding, deleting, and modifying data.

Ilia Alshanetsky FUDForum SQL Injection Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Ilia Alshanetsky FUDForum SQL Injection Vulnerability

Solution:
The following upgrades are available:


Ilia Alshanetsky FUDForum 1.2.8

• Ilia Alshanetsky FUDforum2_20020712.tar.gz
  http://fud.prohost.org/download/FUDforum2_20020712.tar.gz

Ilia Alshanetsky FUDForum 1.9.8

• Ilia Alshanetsky FUDforum2_20020712.tar.gz
  http://fud.prohost.org/download/FUDforum2_20020712.tar.gz

Ilia Alshanetsky FUDForum 2.0.2

• Ilia Alshanetsky FUDforum2_20020712.tar.gz
  http://fud.prohost.org/download/FUDforum2_20020712.tar.gz

Ilia Alshanetsky FUDForum SQL Injection Vulnerability

References:

• FUDForum (Ilia Alshanetsky)