CVE-2007-6237

cp.php in DeluxeBB 1.09 fails to verify that the membercookie matches the authenticated member during profile updates, enabling remote authenticated users to change e-mails for arbitrary accounts via a modified membercookie parameter (a different vector than CVE-2006-4078). This can be leveraged ...

CVE-2006-6237

The CVE-2006-6237 entry describes a SQL injection in Woltlab Burning Board Lite 1.0.2, via the decode_cookie function in thread.php. An attacker can send a crafted threadvisit Cookie parameter to trigger arbitrary SQL execution, with remote, unauthenticated access. The available documents confirm...