Credit: Doz
Class: Input Validation Error
Remote: Yes
Product: MegaBBS ASP Forum Software
Version: v1.5.14b
Vendor: http://www.pd9soft.com/
Description of vulnerable software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vBulletin (abbreviated as vB) is a commercial Internet forum software produced
by Jelsoft Enterprises. It is written in PHP using a MySQL database server.
vBulletin is a professional, affordable community forum solution. Thousands of
clients, including many industry leading blue chip companies, have chosen
vBulletin - It's the ideal choice for any size of community.
http://www.symantec.com/research
Security Advisory
Advisory ID: SYMSA-2007-014
Advisory Title: SQL Injection Vulnerability in Beehive Forum
Software
Author: Nick Bennett
Robert Brown / robert_brown@symantec.com
Release Date: 28-11-2007
Application: Beehive Forum 0.7.1 (earlier versions also
vulnerable)
Description of vulnerable software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vBulletin (abbreviated as vB) is a commercial Internet forum software produced
by Jelsoft Enterprises. It is written in PHP using a MySQL database server.
vBulletin is a professional, affordable community forum solution. Thousands of
clients, including many industry leading blue chip companies, have chosen
vBulletin - It's the ideal choice for any size of community.
Description of vulnerable software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Invision Power Board (abbreviated IPB, IP.Board or IP Board) is an Internet
forum software produced by Invision Power Services, Inc.
It is written in PHP and primarily uses MySQL as a database management system,
although support for other database engines is available.
Vulnerable versions
Reported By: Jacques Copeau
Note
***********
This advisory is part of a survey about vulnerable file uploads in forum
software. The survey will be published after all vendors have fixed their
applications. We will publish no individual advisories, however we will
include the speed, quality of the fix along with the vendor reaction in
the survey.
Description
Description:
Advanced Electron Forum also known as AEF Forum is a full featured
online forum system written in php that allows webmasters and site
owners to host their own discussion forums within their website.
The Advanced Electron Forum software comes bundled with the popular
MKPortal package, but is also available as a free stand alone forum.
Unfortunately there are multiple remote code execution issues within
AEF that allow for an attacker to execute arbitrary php code with
privileges of the affected webserver. This is due to the improper
handling of evaluated bbcode within AEF Forum. Users should upgrade
bbPress 1.0.2 and lower versions were vulnerable to Cross Site Scripting.
2. APPLICATION DESCRIPTION
bbPress is plain and simple forum software, plain and simple with a
twist from the creators of WordPress.
It is focused on web standards, ease of use, ease of integration, and speed.
3. VULNERABILITY DESCRIPTION
This report applies to Subdreamer newest stable release, 2.5.3.2 hotfix#5.
Subdreamer is a content management system, which is written in PHP and uses MySQL as its database backend. Subdreamer's home page is http://www.subdreamer.com
Subdreamer can be integrated with different forum software, so that login authentication & authorization information can be used in the CMS too.
Vulnerability description:
There are vulnerabilities in two integration modules in Subdreamer. Both Invision Power Board 2 and phpBB3 integration modules have this vulnerability.
//----- Application description
Started in 1998, Phorum was the original PHP and MySQL based Open Source
forum software. Phorum's developers pride themselves on creating message
board software that is designed to meet different needs of different web
sites while not sacrificing performance or features.
//----- Description of vulnerability
