[SA16375] XMB Forum Server Set Variable Overwrite and SQL Injection

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

Sql injection and global variables poisoning in XMB Forum 1.9.1

Vendor notified at and partial patch: http://forums.xmbforum.com/viewthread.php?tid=754523 firstly the input validation at xmb.php: foreach $global as $num = $array if isarray$array extract$array, EXTROVERWRITE; this should put to not overwrite any variables cause it overwrite server set variable...

CVE-2004-1864

SQL injection vulnerability in Extreme Messageboard XMB 1.9 beta allows remote attackers to execute arbitrary SQL commands via the restrict parameter to 1 member.php, 2 misc.php, or 3 today.php...

CVE-2004-1862

CVE-2004-1862 concerns multiple reflected XSS flaws in Extreme Messageboard (XMB) versions 1.8 SP3 and 1.9 beta. The vulnerabilities arise from unsafely echoed user-controlled input across several scripts: xmb.php (xmbuser), u2u.php (folder), stats.php (viewmost, replymost, latest), post.php (mes...

CVE-2004-1863

Multiple cross-site scripting XSS vulnerabilities in XMB aka extreme message board 1.9 beta aka Nexus beta allow remote attackers to inject arbitrary web script or HTML via 1 the u2uheader parameter in editprofile.php, the restrict parameter in 2 member.php, 3 misc.php, and 4 today.php, and 5 an...

CVE-2004-1863

CVE-2004-1863 affects XMB (extreme message board) 1.9 beta/Nexus beta. The vulnerability family is cross-site scripting (XSS): remote attackers can inject arbitrary script/HTML via (1) u2uheader in editprofile.php, (2) restrict in member.php, (3) misc.php, (4) today.php, and (5) an arbitrary para...

CVE-2004-1864

CVE-2004-1864 describes an SQL injection vulnerability in Extreme Messageboard (XMB) 1.9 beta. The vulnerability is triggered by the restrict parameter in (1) member.php, (2) misc.php, or (3) today.php, enabling remote attackers to execute arbitrary SQL commands. The NVD entry lists a CVSS v2 bas...

CVE-2005-0885

Multiple cross-site scripting XSS vulnerabilities in XMB Forum 1.9.1 allow remote attackers to inject arbitrary web script or HTML via the 1 Mood or 2 "Send To" fields...

[SA14701] XMB Script Insertion Vulnerabilities

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: XMB Script Insertion Vulnerabilities SECUNIA ADVISORY...

[SA14701] XMB Script Insertion Vulnerabilities

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: XMB Script Insertion Vulnerabilities SECUNIA ADVISORY...

CVE-2005-0885

Multiple cross-site scripting XSS vulnerabilities in XMB Forum 1.9.1 allow remote attackers to inject arbitrary web script or HTML via the 1 Mood or 2 "Send To" fields...

CVE-2005-0885

XMB Forum 1.9.1 is affected by multiple XSS vulnerabilities (via the Mood and “Send To” fields). Exploitation could allow remote script injection in the context of the affected forum pages. The CVE-2005-0885 entry is corroborated by multiple sources (NVD/NIST and CVE list). The provided documents...

XMB Forum < 1.9.10 Multiple Vulnerabilities

The remote host is running XMB Forum, a web forum written in PHP. According to its banner, the version of XMB installed on the remote host suffers from cross-site scripting, SQL injection, and input validation vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

XMB Forum < 1.9.8 SQL Injection and XSS Vulnerabilities

Binary data 2747.prm...

CVE-2004-0323

Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via the 1 ppp parameter in viewthread.php, 2 desc parameter in misc.php, 3 tpp parameter in forumdisplay.php, 4 ascdesc parameter in forumdisplay.php, or 5 the addon...

CVE-2004-1863

Multiple cross-site scripting XSS vulnerabilities in XMB aka extreme message board 1.9 beta aka Nexus beta allow remote attackers to inject arbitrary web script or HTML via 1 the u2uheader parameter in editprofile.php, the restrict parameter in 2 member.php, 3 misc.php, and 4 today.php, and 5 an...

XMB < 1.8 SP1 member.php SQL Injection

Binary data 1546.prm...

waraxe-2004-SA012.txt

================================================================================ waraxe-2004-SA012 ================================================================================ Multiple vulnerabilities in XMB 1.8 Partagium SP3 and 1.9 Nexus Beta...

[waraxe-2004-SA#012 - Multiple vulnerabilities in XMB Forum 1.8 SP3 and 1.9 beta]

================================================================================ waraxe-2004-SA012 ================================================================================ Multiple vulnerabilities in XMB 1.8 Partagium SP3 and 1.9 Nexus Beta...

CVE-2004-0323

Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via the 1 ppp parameter in viewthread.php, 2 desc parameter in misc.php, 3 tpp parameter in forumdisplay.php, 4 ascdesc parameter in forumdisplay.php, or 5 the addon...