CVE-2008-4431

SQL injection vulnerability in index.php in IceBB 1.0-rc9.3 and earlier allows remote attackers to execute arbitrary SQL commands via the skin parameter, probably related to an incorrect protection mechanism in the cleanstring function in includes/functions.php...

CVE-2008-4431

CVE-2008-4431 describes a SQL injection in IceBB 1.0-rc9.3 and earlier, exploitable via the skin parameter in index.php. The root cause is a likely flaw in the protection mechanism within the clean_string function in includes/functions.php, allowing remote attackers to execute arbitrary SQL comma...

CVE-2008-4431: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in IceBB 1.0-rc9.3 and earlier allows remote attackers to execute arbitrary SQL commands via the skin parameter, probably related to an incorrect protection mechanism in the cleanstring function in includes/functions.php...

Sql injection

SQL injection vulnerability in modules/members.php in IceBB before 1.0-rc9.3 allows remote attackers to execute arbitrary SQL commands via the username parameter in a members action to index.php, related to an incorrect protection mechanism in the cleanstring function in includes/functions.php...

CVE-2008-3416

CVE-2008-3416 describes a SQL injection vulnerability in IceBB (before 1.0-rc9.3). The flaw resides in modules/members.php, where remote attackers can inject arbitrary SQL via the username parameter in a members action to index.php, linked to an insufficient protection mechanism in includes/funct...

CVE-2008-3416

SQL injection vulnerability in modules/members.php in IceBB before 1.0-rc9.3 allows remote attackers to execute arbitrary SQL commands via the username parameter in a members action to index.php, related to an incorrect protection mechanism in the cleanstring function in includes/functions.php...

CVE-2008-3416: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in modules/members.php in IceBB before 1.0-rc9.3 allows remote attackers to execute arbitrary SQL commands via the username parameter in a members action to index.php, related to an incorrect protection mechanism in the cleanstring function in includes/functions.php...

IceBB username参数SQL注入漏洞

BUGTRAQ ID: 30381 IceBB是一个基于PHP+MySQL的开源论坛系统。 IceBB的modules/members.php文件没有正确地验证对username参数的输入便用在了SQL查询中： $fleh = $icebb-input; == ... foreach$fleh as $k = $g ... $whereclauses = "$k='$g'"; == ... ... $this-qwhere = implode' AND ',$whereclauses; $total = $db-fetchresult"SELECT COUNT as total FROM...

icebb10-sql.txt

Author: GiReX 26/07/08 Homepage: girex.altervista.org CMS: IceBB \ input'autho...

IceBB <= 1.0-RC9.2 Blind SQL Injection / Session Hijacking Exploit

No description provided by source. Author: GiReX 26/07/08 Homepage: girex.altervista.org CMS: IceBB = 1.0-RC9.2 Site: icebb.net Bug: Blind SQL Injection Exploit: Session Hijacking PoC Works regardless of php.ini settings Description: IceBB is a powerful, fast, free, and open-source forum solution...

IceBB <= 1.0-RC9.2 Blind SQL Injection / Session Hijacking Exploit

Exploit for unknown platform in category web applications ================================================================== IceBB = 1.0-RC9.2 Blind SQL Injection / Session Hijacking Exploit ================================================================== Author: GiReX 26/07/08 Homepage:...

IceBB 1.0-RC9.2 - Blind SQL Injection Session Hijacking

IceBB 1.0-RC9.2 - Blind SQL Injection Session Hijacking Author: GiReX 26/07/08 Homepage: girex.altervista.org CMS: IceBB ...

IceBB 1.0-RC9.2 - Blind SQL Injection / Session Hijacking

Author: GiReX 26/07/08 Homepage: girex.altervista.org CMS: IceBB \ input'author''" Setting author=\ in this query: "SELECT...

icebb-database.txt

./includes/functions.php, line 73 $ip = empty$SERVER'HTTPXFORWARDEDFOR' ? $SERVER'REMOTEADDR' : $SERVER'HTTPXFORWARDEDFOR'; $ip = $this-cleankey$ip; $input'ICEBBUSERIP' = $ip; ./icebb.php, line 169 $icebb-clientip = $input'ICEBBUSERIP'; ./admin/index.php, line 112 $icebb-adsess =...

Sql injection

SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header...

CVE-2007-6083

SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header...

CVE-2007-6083

IceBB 1.0-rc6 contains a SQL injection in admin/index.php exploitable via the X-Forwarded-For HTTP header. Remote attackers can execute arbitrary SQL commands. The connected documents confirm the affected software and vulnerability class, but do not provide remediation steps or patched versions. ...

CVE-2007-6083

SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header...

CVE-2007-6083: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header...

IceBB HTTP_X_FORWARDED_FOR变量远程SQL注入漏洞

BUGTRAQ ID: 26483 IceBB是一个基于PHP+MySQL的开源论坛系统。 IceBB处理畸形用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击，非授权操作数据库。 IceBB的index.php脚本没有正确地验证对X-Forwarded-For HTTP头的输入。在/includes/functions.php文件的73行： $ip = empty$SERVER'HTTPXFORWARDEDFOR' ? $SERVER'REMOTEADDR' : $SERVER'HTTPXFORWARDEDFOR'; $ip = $this-cleankey$ip;...