CVE-2014-10029 SQL injection vulnerability in profile.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to execute arbitrary SQL commands via the req_new_email parameter.
HighCVSS 7.5
EPSS 2.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in profile.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to execute arbitrary SQL commands via the req_new_email parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fluxbb | <= 1.4.11 | No fix listed |
| fluxbb | = 1.5.0 | No fix listed |
| fluxbb | = 1.5.1 | No fix listed |
| fluxbb | = 1.5.2 | No fix listed |
| fluxbb | = 1.5.3 | No fix listed |
| fluxbb | = 1.5.4 | No fix listed |
| fluxbb | = 1.5.5 | No fix listed |
| fluxbb | = 1.5.6 | No fix listed |
References
- fluxbb.org vendor-advisory
- packetstormsecurity.com exploit
- 20141121 FluxBB <= 1.5.6 SQL Injection exploit mailing-list
- 59038 third-party-advisory
- fluxbb-profile-sql-injection(98890) vdb-entry
- fluxbb.org vendor-advisory