phpBB Knowledge Base SQL注入漏洞-安全小百科

phpBB Knowledge Base SQL注入漏洞

漏洞ID	1108664	漏洞类型	SQL注入
发布时间	2005-04-13	更新时间	2005-05-02
CVE编号	CVE-2005-1196	CNNVD-ID	CNNVD-200505-710
漏洞平台	PHP	CVSS评分	7.5

|漏洞来源

https://www.exploit-db.com/exploits/25451
https://www.securityfocus.com/bid/82352
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200505-710

|漏洞详情

phpBB的KnowledgeBase模块中的kb.php存在SQL注入漏洞，远程攻击者可以通过cat参数来获取敏感信息并执行SQL命令。

|漏洞EXP

source: http://www.securityfocus.com/bid/13219/info

Knowledge Base Module is affected by an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/kb.php?mode=cat&cat=0+UNION+SELECT+0,0,0,0,0,0+FROM+phpbb_users+WHERE+1=0

|受影响的产品

phpBB Group phpBB 0

|参考资料

来源:BUGTRAQ
名称:20050418phpBB-KnowledgeBaseMOD-SQL-InjectionandFullPathDisclosure
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=111384185116335&w;=2

相关推荐: Multiple Linksys Devices GET Request Buffer Overflow Vulnerability

Multiple Linksys Devices GET Request Buffer Overflow Vulnerability 漏洞ID 1101277 漏洞类型 Boundary Condition Error 发布时间 2002-12-03 更新时间…

文章版权归作者所有，未经允许请勿转载。

THE END