Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

punBB < 1.2.5 Multiple SQL Injection and Authentication Bypass Vulnerabilities



The remote host is vulnerable to an HTML injection attack.


The remote host is running punBB, a web-based bulletin board. This version of punBB is vulnerable to multiple remote HTML injection attacks. Specifically, failure to correctly parse the 'email' and 'Jabber' variables of the profile page leads to a condition where attackers can insert bogus HTTP headers and content into a client browser session. In order to affect such an attack, the attacker would typically need to be able to entice a remote user into perusing a malicious URI. A successful attack would lead to a loss of confidential data (such as authentication or state cookies) or the execution of malicious code within the browser.


Upgrade to version 1.2.5 or higher.