Multiple Vulnerabilities in MiniBB

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in MiniBB which could be exploited to perform script insertion and SQL injection attacks. 1 Script insertion vulnerability in MiniBB Input passed to the "url" BBCode tag is not properly sanitized. A remote attacker...

CVE-2008-5171: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in admin/minibb/index.php in phpBLASTER CMS 1.0 RC1, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the 1 DB, 2 lang, and 3 skin parameters...

MiniBB PathToFiles Parameter Remote File Include Vulnerability

The remote web server contains a PHP script that is affected by a remote file include issue. Description: The remote web server is running MiniBB, an open source forum software. The version of MiniBB installed on the remote host fails to sanitize input to the 'pathToFiles' parameter before using ...

MiniBB PathToFiles Parameter Remote File Include Vulnerability

The remote web server is running MiniBB, an open source forum software which is affected by a remote file include issue. SPDX-FileCopyrightText: 2008 Justin Seitz Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

miniBB RSS插件远程文件包含漏洞

BUGTRAQ ID: 30421 CNCAN ID：CNCAN-2008073001 miniBB是一款基于PHP的论坛程序。 miniBB不正确过滤用户提交的参数，远程攻击者可以利用漏洞以WEB进程权限执行任意PHP代码。 miniBB包含的RSS插件脚本不正确过滤用户提交的WEB参数，指定远程服务器上的任意文件作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Paul Puzyrev RSS 2.0 目前没有解决方案提供： http://www.minibb.com/download.htmladdons...

minibbrss-rfi.txt

plugin Rss Remote File Inclusion Vulnerability Ghost Hacker, http://gh0st10.wordpress.com |, .-. .-. ,| | o/ \o | R-H team |/ /\ | Found by : Ghost Hacker HomePage : real-hack.net Email : [email protected] Name Script : plugin Rss Download Script :...

MiniBB RSS 2.0 Plugin - Multiple Remote File Inclusions

MiniBB RSS 2.0 Plugin - Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/30421/info The RSS plugin for miniBB is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues can allow an attack...

MiniBB RSS 2.0 Plugin - Multiple Remote File Inclusions

source: https://www.securityfocus.com/bid/30421/info The RSS plugin for miniBB is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues can allow an attacker to compromise the application and the underlying...

Cross site scripting

Cross-site scripting XSS vulnerability in bbadmin.php in miniBB 2.2a allows remote attackers to inject arbitrary web script or HTML via the whatus parameter in a searchusers2 action. NOTE: it was later reported that other versions before 3.0.1 are also vulnerable...

Sql injection

SQL injection vulnerability in bbadmin.php in miniBB 2.2a allows remote attackers to execute arbitrary SQL commands via the whatus parameter in a searchusers2 action. NOTE: it was later reported that other versions before 3.0.1 are also vulnerable...

CVE-2008-2066

Cross-site scripting XSS vulnerability in bbadmin.php in miniBB 2.2a allows remote attackers to inject arbitrary web script or HTML via the whatus parameter in a searchusers2 action. NOTE: it was later reported that other versions before 3.0.1 are also vulnerable...

CVE-2008-2067

SQL injection vulnerability in bbadmin.php in miniBB 2.2a allows remote attackers to execute arbitrary SQL commands via the whatus parameter in a searchusers2 action. NOTE: it was later reported that other versions before 3.0.1 are also vulnerable...

CVE-2008-2066

Cross-site scripting XSS vulnerability in bbadmin.php in miniBB 2.2a allows remote attackers to inject arbitrary web script or HTML via the whatus parameter in a searchusers2 action. NOTE: it was later reported that other versions before 3.0.1 are also vulnerable...

CVE-2008-2067

SQL injection vulnerability in bbadmin.php in miniBB 2.2a allows remote attackers to execute arbitrary SQL commands via the whatus parameter in a searchusers2 action. NOTE: it was later reported that other versions before 3.0.1 are also vulnerable...

CVE-2008-2066

CVE-2008-2066 is a cross‑site scripting (XSS) vulnerability in miniBB’s admin path: bb_admin.php, exploitable via the whatus parameter in the searchusers2 action. Affected: miniBB 2.2a and other versions prior to 3.0.1. Attack vector is remote, enabling injection of arbitrary script/HTML; impact ...

CVE-2008-2067

CVE-2008-2067 is a SQL injection in miniBB 2.2a (and older before 3.0.1) via the whatus parameter in the searchusers2 action of bb_admin.php. Affected versions include at least 2.2a; vulnerability extended to earlier releases per note. Public advisories reference fixes with miniBB 3.0.1; remediat...

CVE-2008-2066: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in bbadmin.php in miniBB 2.2a allows remote attackers to inject arbitrary web script or HTML via the whatus parameter in a searchusers2 action. NOTE: it was later reported that other versions before 3.0.1 are also vulnerable...

CVE-2008-2067: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in bbadmin.php in miniBB 2.2a allows remote attackers to execute arbitrary SQL commands via the whatus parameter in a searchusers2 action. NOTE: it was later reported that other versions before 3.0.1 are also vulnerable...

Path traversal

miniBB 2.2, and possibly earlier, when registerglobals is enabled, allows remote attackers to obtain the full path via a direct request to the glang parameter in a registernew action to index.php, which leaks the path in an error message...

Sql injection

Multiple SQL injection vulnerabilities in 1 setupmysql.php and 2 setupoptions.php in miniBB 2.2 and possibly earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary SQL commands via the xtr parameter in a userinfo action to index.php...