CVE-2008-2029

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in (1) setup_mysql.php and (2) setup_options.php in miniBB 2.2 and possibly earlier, when register_globals is enabled, allow remote attackers to execute arbitrary SQL commands via the xtr parameter in a userinfo action to index.php.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/29997Vendor Advisory
http://www.minibb.net/forums/9_5110_0.htmlExploit
http://www.securityfocus.com/bid/28930Exploit, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/42014
https://www.exploit-db.com/exploits/5494
http://secunia.com/advisories/29997Vendor Advisory
http://www.minibb.net/forums/9_5110_0.htmlExploit
http://www.securityfocus.com/bid/28930Exploit, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/42014
https://www.exploit-db.com/exploits/5494

Timeline

Published: Apr 30, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-20304.3Cross-site scripting (XSS) vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allows remote attackers CVE-2008-20315.0VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a crafted LIST command, which triggers a NULL pointer dereferen CVE-2008-20325.0The FTP service in Acritum Femitter Server 1.03 allows remote attackers to cause a denial of service (crash) by sending multiple crafted RET CVE-2008-20347.5SQL injection vulnerability in wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for WordPress allows remote attackers t CVE-2008-20354.3Cross-site scripting (XSS) vulnerability in the Bluemoon, Inc. (1) BackPack 0.91 and earlier, (2) BmSurvey 0.84 and earlier, (3) newbb_fileu CVE-2008-20367.5SQL injection vulnerability in index.php in dream4 Koobi Pro 6.25 allows remote attackers to execute arbitrary SQL commands via the poll_id CVE-2008-20373.5Multiple cross-site scripting (XSS) vulnerabilities in EditeurScripts EsContacts 1.0 allow remote authenticated users to inject arbitrary we CVE-2008-20386.5Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated a CVE-2008-20407.5Stack-based buffer overflow in the HTTP::getAuthUserPass function (core/common/http.cpp) in Peercast 0.1218 and gnome-peercast allows remote CVE-2008-204110.0Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack vectors and "grave" impact when the web server has CVE-2008-20429.3The Javascript API in Adobe Acrobat Professional 7.0.9 and possibly 8.1.1 exposes a dangerous method, which allows remote attackers to execu CVE-2008-20434.3Multiple cross-site request forgery (CSRF) vulnerabilities in cPanel, possibly 11.18.3 and 11.19.3, allow remote attackers to (1) execute ar