QwikSec

Security Database

CVE

CWE

Training

CVE-2010-4151

Published: Nov 3, 2010

Modified: Aug 7, 2024

PUBLISHED

Description

SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the xthedateformat parameter in a register action, a different vector than CVE-2005-2989, CVE-2006-2503, and CVE-2009-1033.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://www.htbridge.ch/advisory/sql_injection_in_deluxebb.html

x_refsource_MISC

third-party-advisory

x_refsource_SECUNIA

http://www.deluxebb.com/community/topic.php?tid=993

x_refsource_CONFIRM

20101019 SQL injection in DeluxeBB

mailing-list

x_refsource_BUGTRAQ

vdb-entry

x_refsource_BID

deluxebb-xthedateformat-sql-injection(62660)

vdb-entry

x_refsource_XF

http://packetstormsecurity.org/1010-exploits/deluxebb13x-sql.txt

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.