SQL Injection Vulnerability in Fully Modded phpBB by phpBB
CVE-2008-1350

Currently unrated

Key Information:

Vendor

Fully Modded PHPbb

Status
Fully Modded PHPbb
Vendor
CVE Published:
17 March 2008

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2008-1350?

An SQL injection vulnerability exists in the kb.php file of Fully Modded phpBB version 80220. This flaw allows remote attackers to manipulate the database by executing arbitrary SQL commands via the 'k' parameter in specific article actions. Without proper input validation, attackers can exploit this vulnerability to compromise the integrity of the database, potentially leading to unauthorized access or data leakage.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2008-1350 - Proof of Concept

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/41192
vdb-entryx_refsource_XF
http://securityreason.com/securityalert/3745
third-party-advisoryx_refsource_SREASON
https://www.exploit-db.com/exploits/5243
exploitx_refsource_EXPLOIT-DB

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.