Signature Detail
Short Name |
HTTP:PHP:WOLTAB-SQL-INJ |
|---|---|
Severity |
Medium |
Recommended |
No |
Category |
HTTP |
Keywords |
PHP Woltlab Burning Board SQL Injection |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: PHP Woltlab Burning Board SQL Injection
Any user on the bulletin board can comprimise any other user's account by exploiting a vulnerability in board.php. Board.php does not perform proper input validation and therefore is subject to executing user-supplied SQL statements. This is known to affect Woltlab Burning Board 2.0 RC 1 and earlier versions.
Extended Description
WoltLab is prone to SQL injection attacks. This is due to insufficient sanitization of parameters handled by the board.php script, which may be supplied externally via the query string in a web request. The logic of a SQL query made by the script may be modified, resulting in the potential for database corruption. It has been demonstrated that it is possible to exploit this condition to gain administrative privileges within the bulletin board system.
Affected Products
- Woltlab Burning Board 2.0.0 beta 3
- Woltlab Burning Board 2.0.0 beta 4
- Woltlab Burning Board 2.0.0 beta 5
- Woltlab Burning Board 2.0.0 RC1
References
- BugTraq: 5675
- CVE: CVE-2002-1505