bbPress "bb_autop()" Function Remote SQL Query Injection Vulnerability


Description   A vulnerability has been identified in bbPress, which could be exploited by attackers to execute arbitrary SQL queries. This issue is caused by an input validation error in the "bb_autop()" [trunk/bb-includes/formatting-functions.php] function when processing user-supplied data, which could be exploited by malicious users to conduct SQL injection attacks.
     
Vulnerable Products   Vulnerable Software:
bbPress version 0.8.0 and prior
     
Solution   Upgrade to bbPress version 0.8.1 : http://www.bbpress.org/download/
     
CVE   CVE-2007-3244
     
References   http://bbpress.org/blog/2007/02/bbpress-081
http://trac.bbpress.org/ticket/592
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
SQL injection Prevention - GET : suspicious CREATE statement in URL
3.2.0
SQL injection Prevention - GET : suspicious UPDATE SET statement in URL
3.2.0
SQL injection Prevention - GET : suspicious SELECT statement in URL
3.2.0
SQL injection Prevention - GET : suspicious DROP statement in URL
3.2.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2007-06-15 

 Target Type 
Server 

 Possible exploit 
Local & Remote