high7.5Public exploit code

CVE-2005-2058

Multiple SQL injection vulnerabilities in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to execute arbitrary SQL commands via the Number paramet…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

UBBCentral UBB.Threads 5.5.1/6.x - 'grabnext.php?posted' SQL Injection2005-06-24 · webapps · php · Verified
UBBCentral UBB.Threads 5.5.1/6.x - 'notifymod.php?Number' SQL Injection2005-06-24 · webapps · php · Verified
UBBCentral UBB.Threads 5.5.1/6.x - 'addfav.php?main' SQL Injection2005-06-24 · webapps · php · Verified
UBBCentral UBB.Threads 5.5.1/6.x - 'viewmessage.php?message' SQL Injection2005-06-24 · webapps · php · Verified
UBBCentral UBB.Threads 5.5.1/6.x - 'modifypost.php?Number' SQL Injection2005-06-24 · webapps · php · Verified
UBBCentral UBB.Threads 5.5.1/6.x - 'calendar.php' Multiple SQL Injections2005-06-24 · webapps · php · Verified
UBBCentral UBB.Threads 5.5.1/6.x - 'download.php?Number' SQL Injection2005-06-24 · webapps · php · Verified
UBBCentral UBB.Threads < 6.5.2 Beta - 'mailthread.php' SQL Injection2005-06-25 · webapps · php · Verified

Impact

Multiple SQL injection vulnerabilities in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to execute arbitrary SQL commands via the Number parameter to (1) download.php, (2) modifypost.php, (3) mailthread.php, or (4) notifymod.php, (5) month or (6) year parameter to calendar.php, (7) message parameter to viewmessage.php, (8) main parameter to addfav.php, or (9) posted parameter to grabnext.php.

Affected products

Vendor	Product	Affected versions
Ubbcentral	Ubb.Threads	Versions 6.0, 6.0.1, 6.0.2, 6.0.3, 6.1, 6.1.1

Public exploit code

Impact

Affected products

References