CVE-2012-4034
published 2012-08-12CVE-2012-4034: Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to the send…
PriorityP350high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
2.51%
82.8th percentile
Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to the send page, (2) email parameter to the forget page, (3) password parameter to the forum_archive page, (4) section parameter to the management page, (5) section_id parameter to the managementreply page, (6) member_id parameter to the new_password page, or (7) subjectid parameter to the tags page to index.php.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pbboard | pbboard | <= 3.0.1 | — |
| pbboard | pbboard | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mqjr-4xvc-hm4g: Multiple SQL injection vulnerabilities in PBBoard 2
ghsa_unreviewed·2022-05-17
CVE-2012-4034 [HIGH] CWE-89 GHSA-mqjr-4xvc-hm4g: Multiple SQL injection vulnerabilities in PBBoard 2
Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to the send page, (2) email parameter to the forget page, (3) password parameter to the forum_archive page, (4) section parameter to the management page, (5) section_id parameter to the managementreply page, (6) member_id parameter to the new_password page, or (7) subjectid parameter to the tags page to index.php.
GHSA
GHSA-8pf5-3m37-fjrv: SQL injection vulnerability in the CheckEmail function in includes/functions
ghsa_unreviewed·2022-05-14·CVSS 7.5
CVE-2014-9215 [HIGH] CWE-89 GHSA-8pf5-3m37-fjrv: SQL injection vulnerability in the CheckEmail function in includes/functions
SQL injection vulnerability in the CheckEmail function in includes/functions.class.php in PBBoard 3.0.1 before 20141128 allows remote attackers to execute arbitrary SQL commands via the email parameter in the register page to index.php. NOTE: the email parameter in the forget page vector is already covered by CVE-2012-4034.2.
No detection rules found.
No writeups or analysis indexed.
http://osvdb.org/84480http://secunia.com/advisories/50153http://www.pbboard.com/forums/t10352.htmlhttp://www.pbboard.com/forums/t10353.htmlhttp://www.securityfocus.com/bid/54916https://exchange.xforce.ibmcloud.com/vulnerabilities/77501https://www.htbridge.com/advisory/HTB23101http://osvdb.org/84480http://secunia.com/advisories/50153http://www.pbboard.com/forums/t10352.htmlhttp://www.pbboard.com/forums/t10353.htmlhttp://www.securityfocus.com/bid/54916https://exchange.xforce.ibmcloud.com/vulnerabilities/77501https://www.htbridge.com/advisory/HTB23101
2012-08-12
Published