CVE-2004-2754 SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter to the (1...
HighCVSS 7.5
EPSS 2.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter to the (1) recentTopics and (2) welcome functions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yabb se | = 0.8 | No fix listed |
| yabb se | = 1.1.3 | No fix listed |
| yabb se | = 1.4.1 | No fix listed |
| yabb se | = 1.5.0 | No fix listed |
| yabb se | = 1.5.1 | No fix listed |
| yabb se | = 1.5.1_rc1 | No fix listed |
| yabb se | = 1.5.2 | No fix listed |
| yabb se | = 1.5.3 | No fix listed |
| yabb se | = 1.5.4 | No fix listed |
References
- 3371 third-party-advisory
- sourceforge.net patch
- 3618 vdb-entry
- 20040119 Yabb SE SQL Injection exploit mailing-list
- 9449 patch vdb-entry
- 1008764 vdb-entry
- www.yabbse.org