CVE-2005-2058 Multiple SQL injection vulnerabilities in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to execute arbitrary SQL commands via the Number parameter to (1) download.php, (2) modifypost.ph...
HighCVSS 7.5
EPSS 1.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to execute arbitrary SQL commands via the Number parameter to (1) download.php, (2) modifypost.php, (3) mailthread.php, or (4) notifymod.php, (5) month or (6) year parameter to calendar.php, (7) message parameter to viewmessage.php, (8) main parameter to addfav.php, or (9) posted parameter to grabnext.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubbcentral ubb.threads | = 6.0 | No fix listed |
| ubbcentral ubb.threads | = 6.0.1 | No fix listed |
| ubbcentral ubb.threads | = 6.0.2 | No fix listed |
| ubbcentral ubb.threads | = 6.0.3 | No fix listed |
| ubbcentral ubb.threads | = 6.1 | No fix listed |
| ubbcentral ubb.threads | = 6.1.1 | No fix listed |
| ubbcentral ubb.threads | = 6.2 | No fix listed |
| ubbcentral ubb.threads | = 6.2.1 | No fix listed |
| ubbcentral ubb.threads | = 6.2.2 | No fix listed |
| ubbcentral ubb.threads | = 6.2.3 | No fix listed |
| ubbcentral ubb.threads | = 6.3 | No fix listed |
| ubbcentral ubb.threads | = 6.3.1 | No fix listed |
| ubbcentral ubb.threads | = 6.4 | No fix listed |
| ubbcentral ubb.threads | = 6.4.1 | No fix listed |
| ubbcentral ubb.threads | = 6.4.2 | No fix listed |
| ubbcentral ubb.threads | = 6.4.3 | No fix listed |
| ubbcentral ubb.threads | = 6.4.4 | No fix listed |
| ubbcentral ubb.threads | = 6.5 | No fix listed |
| ubbcentral ubb.threads | = 6.5.1 | No fix listed |
| ubbcentral ubb.threads | = 6.5.1.1 | No fix listed |
References
- 20050624 Infopop UBB Threads Multiple Vulnerabilities mailing-list
- www.gulftech.org exploit patch vendor-advisory
- www.ubbcentral.com patch