CVE-2008-2028

miniBB 2.2, and possibly earlier, when registerglobals is enabled, allows remote attackers to obtain the full path via a direct request to the glang parameter in a registernew action to index.php, which leaks the path in an error message...

CVE-2008-2029

Multiple SQL injection vulnerabilities in 1 setupmysql.php and 2 setupoptions.php in miniBB 2.2 and possibly earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary SQL commands via the xtr parameter in a userinfo action to index.php...

CVE-2008-2028

CVE-2008-2028 affects miniBB 2.2 (and possibly earlier) when register_globals is enabled. A direct request to the glang parameter in a registernew action to index.php leaks the full filesystem path in an error message, enabling partial confidentiality disclosure. The vulnerability’s scope and roo...

CVE-2008-2024

Cross-site scripting XSS vulnerability in index.php in miniBB 2.2, and possibly earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the glang parameter in a registernew action...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in miniBB 2.2, and possibly earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the glang parameter in a registernew action...

CVE-2008-2024

CVE-2008-2024 describes a cross-site scripting (XSS) vulnerability in the PHP script index.php of miniBB 2.2 (and possibly earlier) that can be triggered when register_globals is enabled. The issue allows remote attackers to inject arbitrary scripts or HTML via the glang[] parameter in a register...

CVE-2008-2024

Cross-site scripting XSS vulnerability in index.php in miniBB 2.2, and possibly earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the glang parameter in a registernew action...

CVE-2008-2028: Exposure of Sensitive Information to an Unauthorized Actor

miniBB 2.2, and possibly earlier, when registerglobals is enabled, allows remote attackers to obtain the full path via a direct request to the glang parameter in a registernew action to index.php, which leaks the path in an error message...

MiniBB bb_admin.php模块跨站脚本执行漏洞

BUGTRAQ ID: 28957 MiniBB（Minimalistic Bulletin Board）是一个线性的可定制电子布告栏程序。 MiniBB的bbadmin.php文件中没有正确地过滤对whatus参数的输入便返回给了用户，这允许攻击者通过提交恶意HTTP请求导致在用户浏览器会话中执行任意HTML和脚本代码。 MiniBB 2.2a MiniBB ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.minibb.net/authors.html...

MiniBB多个SQL注入和跨站脚本漏洞

BUGTRAQ ID: 28930 MiniBB（Minimalistic Bulletin Board）是一个线性的可定制电子布告栏程序。 MiniBB的实现上存在多个SQL注入漏洞，远程攻击者可能利用此漏洞对服务程序执行SQL注入攻击。 如果将action设置为registernew的话，MiniBB的index.php文件中没有正确地验证对lang参数的输入便返回给了用户，这可能允许攻击者在用户浏览器会话中执行任意HTML和脚本代码。...

CVE-2008-2029: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in 1 setupmysql.php and 2 setupoptions.php in miniBB 2.2 and possibly earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary SQL commands via the xtr parameter in a userinfo action to index.php...

CVE-2008-2024: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in miniBB 2.2, and possibly earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the glang parameter in a registernew action...

miniBB 2.2 - 'bb_admin.php' Cross-Site Scripting Vulnerability

miniBB 2.2 'bbadmin.php' Cross-Site Scripting Vulnerability. Webapps exploit for php platform source: http://www.securityfocus.com/bid/28957/info miniBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue ...

Minibb 2.2a XSS Vulnerability

Minibb 2.2a XSS Vulnerability AUTHOR : IRCRASH Dr.Crash Or Khashayar Fereidani Discovered by : IRCRASH Dr.Crash Or Khashayar Fereidani IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi - Malc0de - R3d.w0rm - Rasool Nasr Script Download : http://www.minibb.net/ XSS XSS Address...

minibb-xss.txt

Minibb 2.2a XSS Vulnerability AUTHOR : IRCRASH Dr.Crash Or Khashayar Fereidani Discovered by : IRCRASH Dr.Crash Or Khashayar Fereidani IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi - Malc0de - R3d.w0rm - Rasool Nasr Script Download : http://www.minibb.net/ XSS Address :...

miniBB 2.2 (CSS/SQL/FPD) Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ======================================================== miniBB 2.2 CSS/SQL/FPD Multiple Remote Vulnerabilities ======================================================== Author: GiReX Date: 21/04/2008 CMS: miniBB 2.2 and maybe prior Site:...

MiniBB 2.2 - Cross-Site Scripting SQL Injection Full Path Disclosure

MiniBB 2.2 - Cross-Site Scripting SQL Injection Full Path Disclosure Author: GiReX Homepage: girex.altervista.org Date: 21/04/2008 CMS: miniBB 2.2 and maybe prior Site: minibb.net Bug 1: Full Path Disclosure Bug 2: Cross Site Scripting Bug 3: Remote SQL Injection Need: registerglobals = On...

MiniBB 2.2 - Cross-Site Scripting / SQL Injection / Full Path Disclosure

Author: GiReX Homepage: girex.altervista.org Date: 21/04/2008 CMS: miniBB 2.2 and maybe prior Site: minibb.net Bug 1: Full Path Disclosure Bug 2: Cross Site Scripting Bug 3: Remote SQL Injection Need: registerglobals = On --------------------------------------- 21/04/2008 Vendor informed 22/04/20...

minibb-xsssql.txt

Author: GiReX Homepage: girex.altervista.org Date: 21/04/2008 CMS: miniBB 2.2 and maybe prior Site: minibb.net Bug 1: Full Path Disclosure Bug 2: Cross Site Scripting Bug 3: Remote SQL Injection Need: registerglobals = On --------------------------------------- 21/04/2008 Vendor informed 22/04/20...

miniBB 2.2 (CSS/SQL/FPD) Multiple Remote Vulnerabilities

No description provided by source. Author: GiReX Homepage: girex.altervista.org Date: 21/04/2008 CMS: miniBB 2.2 and maybe prior Site: minibb.net Bug 1: Full Path Disclosure Bug 2: Cross Site Scripting Bug 3: Remote SQL Injection Need: registerglobals = On ---------------------------------------...