CVE-2012-1603

Loading...

General

Score:7.5/10.0
Severity:High
Category:SQL Injection
Exploit:Available

Impact Metrics

Confidentiality:Partial
Integrity:Partial
Availability:Partial

Exploitability Metrics

Access Vector:Network
Access Complexity:Low
Authentication:None

Published on 02/10/12 - Updated on 02/10/12

Description

Multiple SQL injection vulnerabilities in ajaxserver.php in NextBBS 0.6 allow remote attackers to execute arbitrary SQL commands via the (1) curstr parameter in the findUsers function, (2) id parameter in the isIdAvailable function, or (3) username parameter in the getGreetings function.

Category: SQL Injection

CWE-89 (SQL Injection)
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Security Notices

US National Vulnerability DatabaseCVE-2012-1603

Exploits

Exploit-DBEDB-37012
SecurityFocusBID-52728

Relative technologies

VendorProduct
nextbbsnextbbs

Share this vulnerability with:

Twitter Facebook LinkedIn Mail