oss-security - Re: CVE request: Four issues in PunBB

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Tue, 16 Dec 2008 21:30:12 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: Steven Christey <coley@...us.mitre.org>
Subject: Re: CVE request: Four issues in PunBB

Three CVE's are assigned because the two SQL injections also affect the
same product versions.

- Steve

======================================================
Name: CVE-2008-5433
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5433
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#possible_xss_in_login

Cross-site scripting (XSS) vulnerability in login.php in PunBB 1.3 and
1.3.1 allows remote attackers to inject arbitrary web script or HTML
via the password field.

======================================================
Name: CVE-2008-5434
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5434
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_at_adminusers.php_page
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_in_adminsettings.php_via_configuration_values

Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow
remote authenticated administrators to execute arbitrary SQL commands
via the (1) order_by or (2) direction parameter to admin/users.php, or
(3) configuration options to admin/settings.php.

======================================================
Name: CVE-2008-5435
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5435
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/

Cross-site scripting (XSS) vulnerability in moderate.php in PunBB
before 1.3.1 allows remote attackers to inject arbitrary web script or
HTML via a topic subject.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.