CVE-2004-2754

This CVE concerns a SQL injection in YaBB SE (v1.5.4, 1.5.3, and potentially older before 1.5.5) via the ID_MEMBER parameter to the recentTopics and welcome functions, allowing remote SQL commands. Affected software is YaBB SE; root cause is improper input handling in SSI.php. Impact per sources ...

CVE-2004-2754: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the IDMEMBER parameter to the 1 recentTopics and 2 welcome functions...

YABBSESSI.phpID_MEMBER参数SQL注入漏洞

Yabb Se是一款基于PHP/MySQL的论坛程序。Yabb Se包含的SSI.php没有充分过滤用户提交的URI参数，远程攻击者可以利用这个漏洞进行SQL注入攻击，可能获得敏感信息或修改数据库。SSI.php文件返回一些论坛最近论题，版面统计等一些信息，由于对IDMEMBER参数缺少充分的过滤，攻击者可以提交恶意SQL命令，更改原有数据库逻辑，获得敏感信息或修改数据库。 YaBB 1.5.3-1.5.4 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载升级到YABB SE...