Secunia Advisory: SA10676
Release Date: 2004-01-20

Critical: Moderately critical
Impact: Manipulation of data
Exposure of sensitive information
Where: From remote

Software: YaBB SE 1.x


Description:
BackSpace has identified a vulnerability in YaBB SE, allowing malicious people to conduct SQL injection attacks.

The problem is that the "welcome" and "recentTopics" functions in the "SSI.php" script doesn't verify the "ID_MEMBER" parameter properly. This can be exploited to to view usernames and hashed passwords by manipulating SQL queries.

YaBB SE versions 1.5.4 and 1.5.3 have been reported vulnerable. Prior versions may also be affected.

Solution:
Update to version 1.5.5.
http://www.yabbse.org/download.php

Provided and/or discovered by:
BackSpace

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

Site News

More in Site News