Multiple SQL injection vulnerabilities in OvBB 0.08a allow remote attackers to execute arbitrary SQL commands via the (1) threadid parameter to thread.php and (2) userid parameter to profile.php. NOTE: the vendor disputes these issues, saying these reports are completely unsubstantial.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ovbb | Ovbb | 0.1a (including) | 0.1a (including) |
| Ovbb | Ovbb | 0.2a (including) | 0.2a (including) |
| Ovbb | Ovbb | 0.3a (including) | 0.3a (including) |
| Ovbb | Ovbb | 0.4a (including) | 0.4a (including) |
| Ovbb | Ovbb | 0.5a (including) | 0.5a (including) |
| Ovbb | Ovbb | 0.6a (including) | 0.6a (including) |
| Ovbb | Ovbb | 0.7a (including) | 0.7a (including) |
| Ovbb | Ovbb | 0.8a (including) | 0.8a (including) |
References
- http://pridels0.blogspot.com/2005/11/ovbb-sql-vulnerabilities.html
- http://www.osvdb.org/21307
- http://www.osvdb.org/21308
- http://www.securityfocus.com/bid/15566
- http://pridels0.blogspot.com/2005/11/ovbb-sql-vulnerabilities.html
- http://www.osvdb.org/21307
- http://www.osvdb.org/21308
- http://www.securityfocus.com/bid/15566