Xmb Forum Vunerability

Articles Metasploit Framework Windows Tutorial Remote Desktop Connection Windows Processes That May Be Dangerous How-To use NetCat a Tutorial Common Linux Commands Common Ports Netcat Commands HTTP Response Codes War-Google Hack Terms Wardriving Avoiding Social Engineering and Phishing Attacks Intrusion Detection on Linux Linux Intrusion Detection Penetration Testing Guide Penetration Testing Tools Social Engineering Fundamentals, Part I: Hacker Tactics Social engineering (computer security) The Psychology of Social Engineering The Archives General GSO GovernmentSecurity.org News & Suggestions In The News Open Topic General Security Information Trash Can Exploit & Vulnerability Mailing List Archives Trial Member Forum Product and Program Reviews GSO Tutorials System Security Windows Systems Beginners Section Linux & Unix Systems File Downloads Exploit Research & Discussion Trojan & Virus Errata Networking Security / Firewall / IDS / VPN / Routers System Hardening E-Mail Security Wifi Security Trial Member Uploads Upload discovered Trojans & Mal ware GSO Programming Section C , C++ , VC++ Visual Basic .NET Perl /CGI Java/Javascript PHP/XML/ASP/HTML Assembly + Other The Cork Board Network Security Consultant Directory Network Security Jobs The Archives Encryption Information General Network Security Internet Anonymity HTTP Protocol Security Linux Security MS IIS Information Exploit Articles Programming / Tool Design GSO Software Projects Public Downloads Microsoft Security Questions and Papers		Help - Search - Member List - Calendar Full Version: Xmb Forum Vunerability GovernmentSecurity.org > System Security > Exploit Research & Discussion Crn1vuk5 Aug 15 2005, 10:27 PM QUOTE FrSIRT Advisory : FrSIRT/ADV-2005-1368 CVE Reference : GENERIC-MAP-NOMATCH Rated as : Moderate Risk Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2005-08-10 * Technical Description * Two vulnerabilities were identified in XMB Forum, which could be exploited by malicious users to conduct SQL injection attacks or overwrite server set variables. This first issue is due to an input validation error in the "xmb.php" script when extracting variables, which may be exploited by attackers to overwrite server set variables via a specially crafted form (i.e. "_SERVER[REMOTE_ADDR]"). The second flaw is due to an input validation error in the "include/u2u.inc.php" script when processing a specially crafted "in" variable via the "u2u_select" parameter, which may be exploited by remote users to conduct SQL injection attacks. * Affected Products * XMB Forum version 1.9.1 and prior * Solution * The FrSIRT is not aware of any official supplied patch for this issue. * References * http://www.frsirt.com/english/advisories/2005/1368 http://forums.xmbforum.com/viewthread.php?tid=754523 * Credits * Vulnerabilities reported by Heintz * ChangeLog * 2005-08-10 : Original Advisory I hope someone use this to make exploit... This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here. Invision Power Board © 2001-2005 Invision Power Services, Inc.