CVE-2010-1859

Deluxebb < 1.3 - SQL Injection

Title source: rule

Description

SQL injection vulnerability in newpost.php in DeluxeBB 1.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the membercookie cookie when adding a new thread.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Stefan Esser · textwebappsphp

https://www.exploit-db.com/exploits/33945

View Code ZIP pw:eip

References (2)

Core 2

Core References

Exploit vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/39962

Exploit x_refsource_misc

http://php-security.org/2010/05/06/mops-2010-011-deluxebb-newthread-sql-injection-vulnerability/index.html

Scores

EPSS 0.0023

EPSS Percentile 46.1%

Details

CWE

CWE-89

Status published

Products (9)

deluxebb/deluxebb 1.0

deluxebb/deluxebb 1.1

deluxebb/deluxebb 1.2

deluxebb/deluxebb 1.05

deluxebb/deluxebb 1.06

deluxebb/deluxebb 1.07

deluxebb/deluxebb 1.08

deluxebb/deluxebb 1.09

deluxebb/deluxebb < 1.3

Published May 07, 2010

Tracked Since Feb 18, 2026