CVE-2012-1603

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 1.4%

from disclosure to weapon0 days

Published on NVDOct 1

1st PoCMar 27

exploitation probability

1.4%top 29% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Multiple SQL injection vulnerabilities in ajaxserver.php in NextBBS 0.6 allow remote attackers to execute arbitrary SQL commands via the (1) curstr parameter in the findUsers function, (2) id parameter in the isIdAvailable function, or (3) username parameter in the getGreetings function.

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/37012 cve_referencepacketstormsecurity.org/files/111250/NextBBS-0.6.0-Authentication-Bypass-SQL-Injection-XSS.htmlunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://archives.neohapsis.com/archives/bugtraq/2012-03/0135.html http://packetstormsecurity.org/files/111250/NextBBS-0.6.0-Authentication-Bypass-SQL-Injection-XSS.html http://www.openwall.com/lists/oss-security/2012/03/29/8 http://www.openwall.com/lists/oss-security/2012/03/30/2 http://www.osvdb.org/80637 http://www.securityfocus.com/bid/52728 http://www.waraxe.us/advisory-80.html