20040926 SQL injection in BroadBoard Instant ASP Message Boardmailing list
http://marc.info/?l=bugtraq&m=109630777608244&w=2 CVE-2004-1555
FreezingCold Broadboard - 'search.asp' SQL Injection
Record summary
CVE-2004-1555 has a selected CVSS score of 7.5; EIP currently links 2 catalogued exploits.
Description
Multiple SQL injection vulnerabilities in BroadBoard Instant ASP Message Board allow remote attackers to run arbitrary SQL commands via the (1) keywords parameter to search.asp, (2) handle parameter to profile.asp, (3) txtUserHandle parameter to reg2.asp or (4) txtUserEmail parameter to forgot.asp.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 2
Proofs of concept
2Catalogued exploits
ExploitDBFreezingCold Broadboard - 'search.asp' SQL InjectionExploitDB exploitby pigrelaxNot analyzed1 file
ExploitDBFreezingCold Broadboard - 'profile.asp' SQL InjectionExploitDB exploitby pigrelaxNot analyzed1 file
References
912658Third-party advisory
http://secunia.com/advisories/12658 1011419vdb entry
http://securitytracker.com/id?1011419 11250vdb entry
http://www.securityfocus.com/bid/11250 broadboard-searchasp-sql-injection(17498)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/17498 broadboard-profileasp-sql-injection(17500)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/17500 broadboard-reg2asp-sql-injection(17501)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/17501 broadboard-forgotasp-sql-injection(17502)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/17502 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2004-1555