Vulnerabilities > CVE-2006-6237 - SQL-Injection vulnerability in Woltlab Burning Board Lite 1.0.2
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
SQL injection vulnerability in the decode_cookie function in thread.php in Woltlab Burning Board Lite 1.0.2 allows remote attackers to execute arbitrary SQL commands via the threadvisit Cookie parameter.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Exploit-Db
| description | Woltlab Burning Board Lite 1.0.2 decode_cookie() SQL Injection Exploit. CVE-2006-6237. Webapps exploit for php platform |
| file | exploits/php/webapps/2841.php |
| id | EDB-ID:2841 |
| last seen | 2016-01-31 |
| modified | 2006-11-24 |
| platform | php |
| port | |
| published | 2006-11-24 |
| reporter | rgod |
| source | https://www.exploit-db.com/download/2841/ |
| title | Woltlab Burning Board Lite 1.0.2 decode_cookie SQL Injection Exploit |
| type | webapps |
Nessus
| NASL family | CGI abuses |
| NASL id | BURNING_BOARD_LITE_DECODE_COOKIE_SQL_INJECTION.NASL |
| description | The remote version of Burning Board Lite fails to sanitize user- supplied cookie input before using it in the |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 23733 |
| published | 2006-11-27 |
| reporter | This script is Copyright (C) 2006-2018 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/23733 |
| title | WoltLab Burning Board Lite thread.php decode_cookie Function threadvisit Cookie Parameter SQL Injection |
References
- http://retrogod.altervista.org/wbblite_102_sql_mqg_bypass.html
- http://secunia.com/advisories/23077
- http://securityreason.com/securityalert/1955
- http://www.securityfocus.com/archive/1/452561/100/0/threaded
- http://www.vupen.com/english/advisories/2006/4694
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30561
- https://www.exploit-db.com/exploits/2841