bugtraq - SQL injection in BttlxeForum

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <3EA7466A.10906@securitytracker.com>
Date: Wed, 23 Apr 2003 22:05:30 -0400
From: SecurityTracker <help@...uritytracker.com>
To: bugtraq@...urityfocus.com
Subject: SQL injection in BttlxeForum

Hi,

SAUDI_DEFACERZ reported an input validation vulnerability in the 'bttlxeForum' forum 
software earlier today.  A remote user can gain full control over the application.

You can see the original message from SAUDI_DEFACERZ at:

http://securitytracker.com/alerts/2003/Apr/1006632.html

The vendor responded rapidly to provide a fix:

23 April 2003, 14:43 UTC/GMT - Vendor notified
23 April 2003, 14:56 UTC/GMT - Vendor responded
23 April 2003, 16:03 UTC/GMT - Vendor posted fix
23 April 2003, 16:11 UTC/GMT - Vendor responded to indicate that a fix was available.

See the vendor's bug fix announcement at:

http://www.battleaxesoftware.com/forums/forum.asp?forumid=36&select=1812

CVE Number is CAN-2003-0215.

Stuart