SQL injection in BttlxeForum

From: SecurityTracker (helpat_private)
Date: Wed Apr 23 2003 - 19:05:30 PDT

Next message: euronymous: "BRS WebWeaver: Ftpd Lockdown via RETR cmd"

Previous message: Cisco Systems Product Security Incident Response Team: "Cisco Security Advisory: Cisco Catalyst Enable Password Bypass Vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi,

SAUDI_DEFACERZ reported an input validation vulnerability in the 'bttlxeForum' forum 
software earlier today.  A remote user can gain full control over the application.

You can see the original message from SAUDI_DEFACERZ at:

http://securitytracker.com/alerts/2003/Apr/1006632.html

The vendor responded rapidly to provide a fix:

23 April 2003, 14:43 UTC/GMT - Vendor notified
23 April 2003, 14:56 UTC/GMT - Vendor responded
23 April 2003, 16:03 UTC/GMT - Vendor posted fix
23 April 2003, 16:11 UTC/GMT - Vendor responded to indicate that a fix was available.

See the vendor's bug fix announcement at:

http://www.battleaxesoftware.com/forums/forum.asp?forumid=36&select=1812

CVE Number is CAN-2003-0215.

Stuart

Next message: euronymous: "BRS WebWeaver: Ftpd Lockdown via RETR cmd"
Previous message: Cisco Systems Product Security Incident Response Team: "Cisco Security Advisory: Cisco Catalyst Enable Password Bypass Vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Apr 24 2003 - 09:26:02 PDT