YABB SE 1.5 - Quote SQL Injection

YABB SE 1.5 - Quote SQL Injection source: https://www.securityfocus.com/bid/9674/info It has been reported that YaBB SE may be prone to a SQL injection vulnerability that may allow a remote user to inject arbitrary SQL queries into the database used by the software. YaBB SE versions 1.5.4 and 1.5...

YABB SE 1.5 - 'Quote' SQL Injection

source: https://www.securityfocus.com/bid/9674/info It has been reported that YaBB SE may be prone to a SQL injection vulnerability that may allow a remote user to inject arbitrary SQL queries into the database used by the software. YaBB SE versions 1.5.4 and 1.5.5 have been reported to be affect...

yabbSE.txt

Summary: YaBB SE is a PHP/MySQL port of the popular forum software YaBB yet another bulletin board. An SQL Injection vulnerability in the product allows a remote attacker to insert malicious SQL statements. Details: Vulnerable Systems: Yabb Se version 1.5.4 tested, 1.5.3tested maybe others Immune...

Yabb SE SQL Injection

Summary: YaBB SE is a PHP/MySQL port of the popular forum software YaBB yet another bulletin board. An SQL Injection vulnerability in the product allows a remote attacker to insert malicious SQL statements. Details: Vulnerable Systems: Yabb Se version 1.5.4 tested, 1.5.3tested maybe others Immune...

YABB SE 1.x - SSI.php ID_MEMBER SQL Injection

YABB SE 1.x - SSI.php IDMEMBER SQL Injection source: https://www.securityfocus.com/bid/9449/info A problem with YaBB SE could make it possible for a remote user launch SQL injection attacks. It has been reported that a problem exists in the SSI.php script distributed as part of YaBB SE. Due to...

YABB SE 1.x - 'SSI.php' ID_MEMBER SQL Injection

source: https://www.securityfocus.com/bid/9449/info A problem with YaBB SE could make it possible for a remote user launch SQL injection attacks. It has been reported that a problem exists in the SSI.php script distributed as part of YaBB SE. Due to insufficient sanitizing of user-supplied URI...

CVE-2003-1277

Cross-site scripting XSS vulnerabilities in Yet Another Bulletin Board YaBB 1.5.0 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via cookies by injecting arbitrary HTML or script into 1 newsicon of newstemplate.php, and 2 threadid a...

CVE-2003-0275

SSI.php in YaBB SE 1.5.2 allows remote attackers to execute arbitrary PHP code by modifying the sourcedir parameter to reference a URL on a remote web server that contains the code...

CVE-2003-0275

SSI.php in YaBB SE 1.5.2 allows remote attackers to execute arbitrary PHP code by modifying the sourcedir parameter to reference a URL on a remote web server that contains the code...

CVE-2003-0275

Vulnerability: YaBB SE 1.5.2’s SSI.php is exploitable via the sourcedir parameter, allowing remote attackers to reference a URL containing PHP code and execute it on the affected server. Impact: Partial confidentiality, integrity, and availability per CVSS 2.0 base metrics (5.1). Details: No expl...

II-Labs Advisory: Remote code execution in YaBBse 1.5.2 (php version)

Illegal Instruction Labs Advisory ------------------------------------------------------------------------ Advisory name: Remote code execution in YaBBse 1.5.2 php version Advisory number: 13 Application: Yet another Bulletin Board 1.5.2 Vendor: www.yabbse.org Date: 06.05.2003 Impact: Attacker ca...

ttcms and ttforum exploits

hope this is the right place to send this exploit info, I found three diffrent exploits for a forum software / cms software: ------------------------------------------------------------------------------------------------------------------------------------------------ Affected Product: ttCMS or...

YaBB SE < 1.5.2 Multiple Vulnerabilities

The remote host is using the YaBB SE forum management system. According to its version number, this forum is vulnerable to a code injection bug that could allow an attacker with a valid account to execute arbitrary commands on this host by sending a malformed 'language' parameter in the web...

[NGSEC-2003-5] YABB SE, remote command execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Next Generation Security Technologies http://www.ngsec.com Security Advisory Title: YABB SE, remote command execution. ID: NGSEC-2003-5 Application: YABB SE up to 1.5.1 Date: 04/22/2003 Status: Vendor contacted, new fixed version available. Platforms:...

YABB SE 0.81.41.5 - Packages.php Remote File Inclusion

YABB SE 0.81.41.5 - Packages.php Remote File Inclusion source: https://www.securityfocus.com/bid/6663/info YaBB SE allows remote users to influence the location of included files. A remote attacker may exploit this condition to cause an external, attacker-supplied file to be included and executed...

YABB SE 0.8/1.4/1.5 - 'Packages.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/6663/info YaBB SE allows remote users to influence the location of included files. A remote attacker may exploit this condition to cause an external, attacker-supplied file to be included and executed by YABB SE. This may allow a remote attacker to execut...

[VSA0306] YABBSE 1.4.1 SQL Injection Bugs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Subject: void.at SA YaBB SE SQL Injection Bugs void.at Security Advisory VSA0306 YaBB SE is a web based forum written in PHP. Overview - -------- Due to sql injection bugs, it is possible for an remote user without an account to get access to user...

YABB 1.4.1 SE - Reminder.php SQL Injection

YABB 1.4.1 SE - Reminder.php SQL Injection source: https://www.securityfocus.com/bid/6591/info It has been reported that a problem exists in the Reminder.php script distributed as part of YaBB SE. Due to insufficient sanitizing of input, it is possible for a remote user to inject arbitrary SQL in...

YABB 1.4.1 SE - 'Reminder.php' SQL Injection

source: https://www.securityfocus.com/bid/6591/info It has been reported that a problem exists in the Reminder.php script distributed as part of YaBB SE. Due to insufficient sanitizing of input, it is possible for a remote user to inject arbitrary SQL into the database used by YaBB SE that could ...

CVE-2002-1846

Yet Another Bulletin Board YaBB 1.40 and 1.41 does not require a user to submit the correct password before changing it to a new password, which allows remote attackers to modify passwords by stealing the cookie of another user, modifying the expiretime setting, and submitting the change in a...