CVE-2014-9560 Softbb.net SoftBB SQL Injection Security Vulnerability

CVE-2014-9560 Softbb.net SoftBB SQL Injection Security Vulnerability

Exploit Title: Softbb.net SoftBB /redir_last_post_list.php post Parameter SQL Injection

Product: SoftBB (mods)

Vendor: Softbb.net

Vulnerable Versions: v0.1.3

Tested Version: v0.1.3

Advisory Publication: Jan 10, 2015

Latest Update: Jan 10, 2015

Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) (CWE-89)

CVE Reference: CVE-2014-9560

CVSS Severity (version 2.0):

CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 10.0

Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU), Singapore]

Advisory Details:
Vendor URL:
http://www.softbb.net/

(2) Vulnerability Details:
Softbb.net SoftBB can be exploited by SQL Injection attacks.

(2.1) The vulnerability occurs at “/redir_last_post_list.php” page, with “&post” parameter.

References:

http://tetraph.com/security/cves/cve-2014-9560-softbb-net-softbb-sql-injection-security-vulnerability/

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9560

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9560

http://seclists.org/fulldisclosure/2015/Jan/20

http://packetstormsecurity.com/files/129888/SoftBB-0.1.3-SQL-Injection.html

https://cxsecurity.com/issue/WLB-2015010053

http://www.securityfocus.com/bid/71986

http://www.cnvd.org.cn/flaw/show/CNVD-2015-00351

http://www.intelligentexploit.com/view-details.html?id=20557

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1425

http://milw00rm.net/exploits/6367
http://computerobsess.blogspot.com/2015/02/cve-2014-9560-softbbnet-softbb-sql.html
http://whitehatpost.blog.163.com/blog/static/24223205420151104309866/#