ultimatedisclose.txt

Update: 12:15 AM 5/14/2005 Subject: " Ultimate Forum Password Database Vulnerability " Vulnerable version: Ultimate Forum 1.0 Description: Ultimate forum is an Open forum i.e. no logon restrictions or private areas. Forum is a text file based. Each forum is multithreaded and stored in a separate...

UltimatePHPBoard.txt

Ultimate PHP Board UPB Security Advisory By : Morinex e-mail : morinexatmarocmafia com date : 13-05-2k5 shoutz : w00pie.nl Target : Ultimate PHP Board UPB Vulnerable Versions: v. 1.8 until v 1.9.6 URL : http://www.myupb.com - http://www.myupb.com/forum/ Tested Localhost , Myupb.com. UPB is a...

CVE-2002-1821

Affected software: Ultimate PHP Board (UPB) 1.0 and 1.0b. Vulnerability: Remote authenticated users can gain privileges and perform unauthorized actions by making direct requests to specific admin pages: admin_members.php, admin_config.php, admin_cat.php, and admin_forum.php. Root cause/impact: T...

CVE-2002-1820

register.php in Ultimate PHP Board UPB 1.0 and 1.0b uses an administrative account Admin with a capital "A," but allows a remote attacker to impersonate the administrator by registering an account name of admin with a lower case "a."...

CVE-2002-1821

Ultimate PHP Board UPB 1.0 and 1.0b allows remote authenticated users to gain privileges and perform unauthorized actions via direct requests to 1 adminmembers.php, 2 adminconfig.php, 3 admincat.php, or 4 adminforum.php...

CVE-2002-1820

The CVE-2002-1820 entry concerns Ultimate PHP Board (UPB) versions 1.0 and 1.0b where register.php uses an administrative account named Admin (capital A) but allows a remote attacker to impersonate the administrator by registering a user named admin (lowercase a). The root cause is inconsistent c...

CVE-2005-2004

Vulnerability summary (CVE-2005-2004): Multiple cross-site scripting flaws affect Ultimate PHP Board (UPB) 1.9.6 GOLD and earlier. The issues arise from insufficient sanitization of user input in several scripts, enabling remote attackers to inject arbitrary web script or HTML via any of these pa...

CVE-2005-2004

Multiple cross-site scripting vulnerabilities in Ultimate PHP Board UPB 1.9.6 GOLD and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 ref parameter to login.php, 2 id or 3 page parameter to viewtopic.php, id parameter to 4 profile.php, 5 newpost.php, 6 email.php, ...

CVE-2005-2005

CVE-2005-2005 affects Ultimate PHP Board (UPB) 1.9.6 GOLD and earlier. The vulnerability arises because UPB stores the users.dat file under the web document root with insufficient access control, allowing remote attackers to directly request db/users.dat and obtain sensitive user information. Rel...

CVE-2005-2005

Ultimate PHP Board UPB 1.9.6 GOLD and earlier stores the users.dat file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information on registered users via a direct request to db/users.dat...

CVE-2005-2003

Ultimate PHP Board UPB 1.9.6 GOLD allows remote attackers to obtain sensitive information via an invalid zero id parameter to 1 viewtopic.php, 2 profile.php, or 3 newpost.php, which reveals the path in an error message...

CVE-2005-2004

Multiple cross-site scripting vulnerabilities in Ultimate PHP Board UPB 1.9.6 GOLD and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 ref parameter to login.php, 2 id or 3 page parameter to viewtopic.php, id parameter to 4 profile.php, 5 newpost.php, 6 email.php, ...

M4DR007-06SA (security advisory): Multiple vulnerabilities in UPB 1.9.6 GOLD

M4DR007-06SA security advisory: Multiple vulnerabilities in UPB 1.9.6 GOLD Published: 06 16 2005 Released: 06 16 2005 Name: Ultimate PHP Board UPB Affected Systems: = 1.9.6 GOLD Issue: Full Path Disclosure, Cross-Site Scripting, Sensitive Information Disclosure Author: Alberto Trivero Vendor:...

CVE-2005-2003

Ultimate PHP Board UPB 1.9.6 GOLD allows remote attackers to obtain sensitive information via an invalid zero id parameter to 1 viewtopic.php, 2 profile.php, or 3 newpost.php, which reveals the path in an error message...

CVE-2005-2005

Ultimate PHP Board UPB 1.9.6 GOLD and earlier stores the users.dat file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information on registered users via a direct request to db/users.dat...

Ultimate PHP Board 1.8/1.9 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/13971/info Ultimate PHP Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issues to have arbitrary script...

Ultimate PHP Board <= 1.9.6 GOLD users.dat Password Decryptor

No description provided by source. !/usr/bin/perl Passwords Decrypter for UPB = 1.9.6 Related advisory: http://www.securityfocus.com/archive/1/402461/30/0/threaded Discovered and Coded by Alberto Trivero Password file is located at: http://www.example.com/upb/db/users.dat /str0ke use Getopt::Std;...

Ultimate PHP Board <= 1.9.6 GOLD users.dat Password Decryptor

Exploit for unknown platform in category web applications ============================================================= Ultimate PHP Board = 1.9.6 GOLD users.dat Password Decryptor ============================================================= !/usr/bin/perl Passwords Decrypter for UPB = 1.9.6...

Ultimate PHP Board 1.81.9 - Weak Password Encryption

Ultimate PHP Board 1.81.9 - Weak Password Encryption source: https://www.securityfocus.com/bid/13975/info Ultimate PHP Board is prone to a weak password encryption vulnerability. This issue is due to a failure of the application to protect passwords with a sufficiently effective encryption scheme...

CVE-2005-1648

Gurgens GASoft Ultimate Forum 1.0 stores the db/Genid.dat database file under the web document root with insufficient access control, which allows remote attackers to obtain and decrypt usernames and passwords...