miniBB SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	61116
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 11 2013 12:00AM
Updated:	Jul 11 2013 12:00AM
Credit:	Netsparker Web Application Security Scanner.
Vulnerable:
Not Vulnerable:

miniBB SQL Injection and Multiple Cross Site Scripting Vulnerabilities

miniBB is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities.

Successful exploits could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

miniBB 3.0.0 is vulnerable; other versions may also be affected.

miniBB SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Attackers can use a browser to exploit the SQL-injection issue. An attacker must trick a victim into following a malicious URI to exploit cross-site scripting issues.

The following example URI is available:

http://www.example.com/bb_admin.php?action=searchusers2&searchus=id&whatus='+(SELECT 1 FROM (SELECT SLEEP(25))A)+'

• /data/vulnerabilities/exploits/60079.txt

miniBB SQL Injection and Multiple Cross Site Scripting Vulnerabilities

Solution:
Reportedly these issues are fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

miniBB SQL Injection and Multiple Cross Site Scripting Vulnerabilities

References:

• miniBB Homepage (miniBB)