CVE-2012-4034

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to the send page, (2) email parameter to the forget page, (3) password parameter to the forum_archive page, (4) section parameter to the management page, (5) section_id parameter to the managementreply page, (6) member_id parameter to the new_password page, or (7) subjectid parameter to the tags page to index.php.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/84480
http://secunia.com/advisories/50153Vendor Advisory
http://www.pbboard.com/forums/t10352.htmlURL Repurposed
http://www.pbboard.com/forums/t10353.htmlVendor Advisory, URL Repurposed
http://www.securityfocus.com/bid/54916Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/77501
https://www.htbridge.com/advisory/HTB23101Exploit
http://osvdb.org/84480
http://secunia.com/advisories/50153Vendor Advisory
http://www.pbboard.com/forums/t10352.htmlURL Repurposed
http://www.pbboard.com/forums/t10353.htmlVendor Advisory, URL Repurposed
http://www.securityfocus.com/bid/54916Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/77501
https://www.htbridge.com/advisory/HTB23101Exploit

Timeline

Published: Aug 12, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-40357.5The new_password page in PBBoard 2.1.4 allows remote attackers to change the password of arbitrary user accounts via the member_id and new_p CVE-2012-40366.8Unrestricted file upload vulnerability in admin.php in PBBoard 2.1.4 allows remote administrators to execute arbitrary PHP code by uploading CVE-2012-40372.6Multiple cross-site scripting (XSS) vulnerabilities in the web client in Transmission before 2.61 allow remote attackers to inject arbitrary CVE-2012-40434.3Cross-site scripting (XSS) vulnerability in global-protect/login.esp in Palo Alto Networks Global Protect Portal, Global Protect Gateway, an CVE-2012-40457.5Multiple heap-based buffer overflows in bmp.w5s in Winamp before 5.63 build 3235 allow remote attackers to execute arbitrary code via the (1 CVE-2012-40463.3The D-Link DCS-932L camera with firmware 1.02 allows remote attackers to discover the password via a UDP broadcast packet, as demonstrated b CVE-2012-40483.3The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of CVE-2012-40492.9epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote CVE-2012-405010.0Multiple unspecified vulnerabilities in Google Chrome OS before 21.0.1180.50 on the Cr-48 and Samsung Series 5 and 5 550 Chromebook platform CVE-2012-40516.8Multiple cross-site request forgery (CSRF) vulnerabilities in editAccount.html in the JAMF Software Server (JSS) interface in JAMF Casper Su CVE-2012-40524.3Multiple cross-site scripting (XSS) vulnerabilities in Jease before 2.9, when creating a comment, allow remote attackers to inject arbitrary CVE-2012-40536.8Cross-site request forgery (CSRF) vulnerability in eZOE flash player in eZ Publish 4.1 through 4.6 allows remote attackers to hijack the aut