FKIE_CVE-2004-0323

Vulnerability from fkie_nvd - Published: 2004-12-31 05:00 - Updated: 2025-04-03 01:03
Severity ?
Summary
Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via the (1) ppp parameter in viewthread.php, (2) desc parameter in misc.php, (3) tpp parameter in forumdisplay.php, (4) ascdesc parameter in forumdisplay.php, or (5) the addon parameter in stats.php. NOTE: it has also been shown that item (3) is also in XMB 1.9 beta.
References
cve@mitre.orghttp://archives.neohapsis.com/archives/bugtraq/2004-02/0645.html
cve@mitre.orghttp://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html
cve@mitre.orghttp://marc.info/?l=bugtraq&m=107756526625179&w=2
cve@mitre.orghttp://www.securityfocus.com/bid/9726Exploit, Patch
cve@mitre.orghttp://www.xmbforum.com/community/boards/viewthread.php?tid=746859
cve@mitre.orghttps://docs.xmbforum2.com/index.php?title=Security_Issue_History
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/15295
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.html
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=107756526625179&w=2
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/9726Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108http://www.xmbforum.com/community/boards/viewthread.php?tid=746859
af854a3a-2127-422b-91ae-364da2661108https://docs.xmbforum2.com/index.php?title=Security_Issue_History
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/15295
Impacted products
Vendor Product Version
xmb_forum xmb 1.8
xmb_forum xmb 1.8_sp1
xmb_forum xmb 1.8_sp2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xmb_forum:xmb:1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "368C1906-D897-46D8-A47E-D321311EE393",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xmb_forum:xmb:1.8_sp1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1A6D868-8DB9-40AF-82C5-D9697876F91E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xmb_forum:xmb:1.8_sp2:*:*:*:*:*:*:*",
              "matchCriteriaId": "5016F4A0-C50A-4B27-B0E3-4FAA4D1645EF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via the (1) ppp parameter in viewthread.php, (2) desc parameter in misc.php, (3) tpp parameter in forumdisplay.php, (4) ascdesc parameter in forumdisplay.php, or (5) the addon parameter in stats.php.  NOTE: it has also been shown that item (3) is also in XMB 1.9 beta."
    }
  ],
  "id": "CVE-2004-0323",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2004-12-31T05:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=107756526625179\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/9726"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.xmbforum.com/community/boards/viewthread.php?tid=746859"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://docs.xmbforum2.com/index.php?title=Security_Issue_History"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15295"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=107756526625179\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/9726"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.xmbforum.com/community/boards/viewthread.php?tid=746859"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.xmbforum2.com/index.php?title=Security_Issue_History"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15295"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vendorComments": [
    {
      "comment": "XMB versions 1.9.8 SP2 and later were checked and are not vulnerable.",
      "lastModified": "2008-12-11T00:00:00",
      "organization": "XMB"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.