Infopop UBB Threads Multiple Vulnerabilities Advisory (XSS/SQLi/CSRF/LFI)

Critical Vulnerability Information Basic Information Vulnerability Title: Infopop UBB Threads Multiple Vulnerabilities Researchers: GulfTech Security Research Date: 2005-06-24 Affected Versions: All Versions Prior To 6.5.2 Beta Vulnerability Details 1. Cross-Site Scripting (XSS) - Description: Multiple XSS vulnerabilities exist, allowing attackers to inject malicious scripts. - Impact: Can steal user-sensitive information or execute malicious code. 2. SQL Injection - Description: Multiple SQL injection vulnerabilities exist, enabling attackers to manipulate databases or leak sensitive data. - Example: - Exploitation: For instance, in private messaging functions, attackers can retrieve user password hashes. 3. Cross-Site Request Forgery (CSRF) - Description: CSRF vulnerabilities exist, allowing attackers to modify users’ ignore lists and address settings. - Example: 4. HTTP Response Splitting - Description: HTTP response splitting vulnerability exists, enabling attackers to manipulate returned HTTP headers. - Affected Files: , , 5. Local File Inclusion - Description: Local file inclusion vulnerability exists when processing language preferences. - Exploitation: Attackers can specify arbitrary file paths via language parameters, potentially leading to code execution or file disclosure. Solution A new version has been released to fix the above issues. Users are strongly advised to upgrade to the latest version immediately. Related Links Security Update Information: URL Original Announcement: URL

Goal Reached Thanks to every supporter — we hit 100%!

Infopop UBB Threads Multiple Vulnerabilities Advisory (XSS/SQLi/CSRF/LFI)