Title: cyberBB Multiple SQL Injection Vulnerabilities
Severity: MODERATE
Description:
cyberBB is a web-based forum application implemented in PHP.
The application is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. The following scripts and parameters are vulnerable:
'showtopic.php':'id'
'profile.php':'user'
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Note that exploiting the issue with 'profile.php' may require the server 'get_magic_quotes_gpc' to be set to 'off'.
Affected Products:
- Sascha Riemer cyberBB 0.6
References:
- Sascha Riemer: cyberBB Homepage