Home
Reading
Searching
Subscribe
Sponsors
Statistics
Posting
Contact
Spam
Lists
Links
About
Hosting
Filtering
Features Download
Marketing
Archives
FAQ
Blog
 
Gmane
From: Jing Wang <justqdjing-Re5JQEeQqe8AvxtiuMwx3w <at> public.gmane.org>
Subject: [FD] CVE-2014-9560 Softbb.net SoftBB SQL Injection Security Vulnerability
Newsgroups: gmane.comp.security.fulldisclosure
Date: Saturday 10th January 2015 04:44:30 UTC (over 2 years ago)
*CVE-2014-9560  Softbb.net SoftBB SQL Injection Security Vulnerability*




Exploit Title: Softbb.net SoftBB /redir_last_post_list.php post Parameter
SQL Injection
Product: SoftBB (mods)
Vendor: Softbb.net
Vulnerable Versions: v0.1.3
Tested Version: v0.1.3
Advisory Publication: Jan 10, 2015
Latest Update: Jan 10, 2015
Vulnerability Type: Improper Neutralization of Special Elements used in an
SQL Command ('SQL Injection') (CWE-89)
CVE Reference: CVE-2014-9560
Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU),
Singapore]






*Advisory Details:*


*Vendor URL:*
http://www.softbb.net/



*(2) Vulnerability Details:*
Softbb.net SoftBB can be exploited by SQL Injection attacks.


*(2.1) *The vulnerability occurs at “/redir_last_post_list.php" page,
with
“&post” parameter.




*References:*
http://tetraph.com/security/cves/cve-2014-9560-softbb-net-softbb-sql-injection-security-vulnerability/
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9560
http://www.cvedetails.com/cve/CVE-2006-1327/








--
Wang Jing
School of Physical and Mathematical Sciences (SPMS)
Nanyang Technological University (NTU), Singapore

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
 
CD: 4ms