CVE-2004-0323: SQL Injection
First published: Thu Mar 18 2004(Updated: )
Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via the (1) ppp parameter in viewthread.php, (2) desc parameter in misc.php, (3) tpp parameter in forumdisplay.php, (4) ascdesc parameter in forumdisplay.php, or (5) the addon parameter in stats.php. NOTE: it has also been shown that item (3) is also in XMB 1.9 beta.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| XMB Forum | =1.8_sp1 | |
| XMB Forum | =1.8 | |
| XMB Forum | =1.8_sp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/9726
- http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.html
- http://www.xmbforum.com/community/boards/viewthread.php?tid=746859
- http://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html
- http://marc.info/?l=bugtraq&m=107756526625179&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15295
- https://docs.xmbforum2.com/index.php?title=Security_Issue_History
Frequently Asked Questions
What is the severity of CVE-2004-0323?
CVE-2004-0323 is considered a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2004-0323?
To fix CVE-2004-0323, it is recommended to upgrade to the latest patched version of XMB that addresses these SQL injection vulnerabilities.
Which versions of XMB are affected by CVE-2004-0323?
CVE-2004-0323 affects XMB version 1.8 and its subversions, including 1.8_sp1 and 1.8_sp2.
What can an attacker achieve with CVE-2004-0323?
An attacker exploiting CVE-2004-0323 can inject arbitrary SQL commands, potentially gaining unauthorized access and privileges.
How can I detect if my site is vulnerable to CVE-2004-0323?
To detect if your site is vulnerable to CVE-2004-0323, you can perform security scans focusing on SQL injection vectors in the affected parameters.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/remedy
- agent/author
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/xmb forum
- canonical/xmb forum
- version/xmb forum/1.8_sp1
- version/xmb forum/1.8
- version/xmb forum/1.8_sp2