20051026 Woltlab Burning Board info_db.php multiple SQL injectionmailing list
http://marc.info/?l=bugtraq&m=113034480129309&w=2 CVE-2005-3369
Woltlab 1.1/2.x - 'Info-DB Info_db.php' Multiple SQL Injections
Record summary
CVE-2005-3369 has a selected CVSS score of 7.5; EIP currently links 1 catalogued exploit.
Description
Multiple SQL injection vulnerabilities in the Info-DB module (info_db.php) in Woltlab Burning Board 2.7 and earlier allow remote attackers to execute arbitrary SQL commands and possibly upload files via the (1) fileid and (2) subkatid parameters.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBWoltlab 1.1/2.x - 'Info-DB Info_db.php' Multiple SQL InjectionsExploitDB exploitby admin@batznet.comNot analyzed1 file
References
817347Third-party advisory
http://secunia.com/advisories/17347 119Third-party advisory
http://securityreason.com/securityalert/119 20330vdb entry
http://www.osvdb.org/20330 15214vdb entry
http://www.securityfocus.com/bid/15214 ADV-2005-2224vdb entry
http://www.vupen.com/english/advisories/2005/2224 wbb-infodb-sql-injection(22887)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/22887 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2005-3369