CVE-2006-0139 | Vulnerability Database | Aqua Security

The send-private-message functionality (send-private-message.asp) in PD9 Software MegaBBS 2.1 allows remote attackers to read private messages of other users via a modified replyid parameter.

Affected Software

Name	Vendor	Start Version	End Version
Megabbs	Pd9_software	2.0 (including)	2.0 (including)
Megabbs	Pd9_software	2.1 (including)	2.1 (including)

References

http://secunia.com/advisories/18342
http://securitytracker.com/id?1015452
http://www.hamid.ir/security/megabbs.txt
http://www.pd9soft.com/megabbs/forums/thread-view.asp?tid=4924
http://www.securityfocus.com/bid/16168
http://www.vupen.com/english/advisories/2006/0095
https://exchange.xforce.ibmcloud.com/vulnerabilities/24050
http://secunia.com/advisories/18342
http://securitytracker.com/id?1015452
http://www.hamid.ir/security/megabbs.txt
http://www.pd9soft.com/megabbs/forums/thread-view.asp?tid=4924
http://www.securityfocus.com/bid/16168
http://www.vupen.com/english/advisories/2006/0095
https://exchange.xforce.ibmcloud.com/vulnerabilities/24050

NVD	https://nvd.nist.gov/vuln/detail/CVE-2006-0139
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html