EUVD-2005-2576

Malware in sbrugna...

Sql injection

Multiple SQL injection vulnerabilities in XMB Forums 1.9.3 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 $u2uselect array parameter to u2u.inc.php and 2 $val variable fidpw0 cookie value in today.php...

CVE-2005-2575

CVE-2005-2575: XMB Forum 1.9.1 contains a SQL injection in u2u.inc.php that allows remote attackers to inject arbitrary SQL via values inserted into the $in variable. This is a web application vulnerability affecting XMB Forum’s PHP code as described in the CVE entry and related records. The prov...

Sql injection and global variables poisoning in XMB Forum 1.9.1

Vendor notified at and partial patch: http://forums.xmbforum.com/viewthread.php?tid=754523 firstly the input validation at xmb.php: foreach $global as $num = $array if isarray$array extract$array, EXTROVERWRITE; this should put to not overwrite any variables cause it overwrite server set variable...