OpenBB Index.PHP Remote SQL Injection Vulnerability
BID:7401
Info
OpenBB Index.PHP Remote SQL Injection Vulnerability
| Bugtraq ID: | 7401 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 22 2003 12:00AM |
| Updated: | Apr 22 2003 12:00AM |
| Credit: | Discovery credited to Albert Puigsech Galicia <[email protected]>. |
| Vulnerable: |
OpenBB OpenBB 1.1 .0 OpenBB OpenBB 1.0.5 |
| Not Vulnerable: | |
Discussion
OpenBB Index.PHP Remote SQL Injection Vulnerability
It has been reported that OpenBB does not properly check input passed via the 'index.php' script. Because of this, an attacker may be able to inject arbitrary commands to the database in the context of the bulletin board software. The consequences will vary depending on the underlying database implementation.
It has been reported that OpenBB does not properly check input passed via the 'index.php' script. Because of this, an attacker may be able to inject arbitrary commands to the database in the context of the bulletin board software. The consequences will vary depending on the underlying database implementation.
Exploit / POC
OpenBB Index.PHP Remote SQL Injection Vulnerability
The following proof of concept has been made available by Albert Puigsech Galicia <[email protected]>:
http://www.example.com/index.php?CID=1%20<something>
where <something> represents a SQL query.
The following proof of concept has been made available by Albert Puigsech Galicia <[email protected]>:
http://www.example.com/index.php?CID=1%20<something>
where <something> represents a SQL query.
Solution / Fix
OpenBB Index.PHP Remote SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.