OpenBB Index.PHP Remote SQL Injection Vulnerability

Bugtraq ID:	9300
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 26 2003 12:00AM
Updated:	Dec 26 2003 12:00AM
Credit:	The disclosure of this issue has been credited to Niels Teusink <[email protected]>.
Vulnerable:	OpenBB OpenBB 1.0.6
Not Vulnerable:

OpenBB Index.PHP Remote SQL Injection Vulnerability

It has been reported that OpenBB does not properly check input passed via the 'index.php' script. Because of this, an attacker may be able to inject arbitrary commands to the database in the context of the bulletin board software. The consequences will vary depending on the underlying database implementation.

OpenBB 1.06 has been reported to be prone this issue, however, other versions could be affected as well.

This issue may be related to BID 7401.

OpenBB Index.PHP Remote SQL Injection Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

OpenBB Index.PHP Remote SQL Injection Vulnerability

Solution:
The vendor has reportedly fixed this issue in version 1.0.6. Users are advised to obtain the fixed version from the vendor.

OpenBB Index.PHP Remote SQL Injection Vulnerability

References:

• OpenBB Homepage (OpenBB)
  
• OpenBB 1.06 SQL Injection ([email protected])