Vulnerabilities > CVE-2004-1555 - Unspecified vulnerability in Broadboard Instant ASP Message Board

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
broadboard-instant
nessus
exploit available
NVD
Published: 2004-12-31
Updated: 2024-11-20

Summary

Multiple SQL injection vulnerabilities in BroadBoard Instant ASP Message Board allow remote attackers to run arbitrary SQL commands via the (1) keywords parameter to search.asp, (2) handle parameter to profile.asp, (3) txtUserHandle parameter to reg2.asp or (4) txtUserEmail parameter to forgot.asp.

Vulnerable Configurations

Part Description Count
Application
Broadboard_Instant
1

Exploit-Db

  • descriptionFreezingCold Broadboard search.asp SQL Injection. CVE-2004-1555. Webapps exploit for asp platform
    idEDB-ID:24625
    last seen2016-02-02
    modified2004-09-27
    published2004-09-27
    reporterpigrelax
    sourcehttps://www.exploit-db.com/download/24625/
    titleFreezingCold Broadboard search.asp SQL Injection
  • descriptionFreezingCold Broadboard profile.asp SQL Injection. CVE-2004-1555. Webapps exploit for asp platform
    idEDB-ID:24626
    last seen2016-02-02
    modified2004-09-27
    published2004-09-27
    reporterpigrelax
    sourcehttps://www.exploit-db.com/download/24626/
    titleFreezingCold Broadboard profile.asp SQL Injection

Nessus

NASL familyCGI abuses
NASL idBROADBOARD_SQL_INJECTION.NASL
descriptionThe remote host appears to be running BroadBoard, an ASP script designed to manage a web-based bulletin-board system. There is a flaw in the remote software that could allow a remote attacker to inject arbitrary SQL commands, which could in turn be used to gain administrative access on the remote host.
last seen2020-06-01
modified2020-06-02
plugin id14828
published2004-09-27
reporterThis script is Copyright (C) 2004-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/14828
titleBroadBoard Multiple Script SQL Injection
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");


if(description)
{
 script_id(14828);
 script_cve_id("CVE-2004-1555");
 script_bugtraq_id(11250);
 script_version("1.23");
 script_xref(name:"Secunia", value:"12658");

 script_name(english:"BroadBoard Multiple Script SQL Injection");
 script_summary(english:"SQL Injection");
 
 script_set_attribute(attribute:"synopsis", value:
"The remote web server is hosting an application written in ASP with
multiple SQL injection vulnerabilities." );
 script_set_attribute(attribute:"description", value:
"The remote host appears to be running BroadBoard, an ASP script
designed to manage a web-based bulletin-board system.

There is a flaw in the remote software that could allow a remote
attacker to inject arbitrary SQL commands, which could in turn be used
to gain administrative access on the remote host." );
 script_set_attribute(
   attribute:"see_also",
   value:"https://seclists.org/fulldisclosure/2004/Sep/971"
 );
 script_set_attribute(
   attribute:"solution", 
   value:"Upgrade to the latest version of BroadBoard."
 );
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
 script_set_cvss_temporal_vector("CVSS2#E:F/RL:U/RC:ND");
 script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
 script_set_attribute(attribute:"exploit_available", value:"true");
 script_set_attribute(attribute:"plugin_publication_date", value: "2004/09/27");
 script_set_attribute(attribute:"vuln_publication_date", value: "2004/09/26");
 script_cvs_date("Date: 2018/11/15 20:50:16");

 script_set_attribute(attribute:"plugin_type", value:"remote");
 script_end_attributes();

 script_category(ACT_GATHER_INFO);
 script_family(english:"CGI abuses");
 
 script_copyright(english:"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc.");
 script_dependencie("find_service1.nasl", "http_version.nasl");
 script_require_ports("Services/www", 80);
 script_exclude_keys("Settings/disable_cgi_scanning");
 script_require_keys("www/ASP");
 exit(0);
}

# Check starts here
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");

port = get_http_port(default:80);
if (! can_host_asp(port:port)) exit(0);


function check(dir)
{
  local_var buf, r;
  r = http_send_recv3(method:"GET", item:dir + "/profile.asp?handle=foo'", port:port);
  if (isnull(r)) exit(0);
  buf = strcat(r[0], r[1], '\r\n', r[2]);

  if("error '80040e14'" >< buf &&
     "'tblUsers.UserHandle='foo'''" >< buf )
  	{
	security_hole(port);
	set_kb_item(name: 'www/'+port+'/SQLInjection', value: TRUE);
	exit(0);
	}
 
 
 return(0);
}

foreach dir (cgi_dirs()) 
 {
  check(dir:dir);
 }

References