HTTP: LokwaBB Private Message Disclosure (3)

This signature detects attempts to exploit a known vulnerability in the LokwaBB Web application, a Web bulletin board based on PHP and MySQL. Versions 1.2.2 and prior are vulnerable. Attackers can retrieve private messages not addressed to them.

Extended Description

Lokwa BB is a freely available message board forum. Versions of Lokwa are subject to SQL injection attacks. Lokwa BB does not properly validate externally-supplied input when including arbitrary characters and additional SQL statements in an SQL query. As a result, attackers may be able to modify SQL queries performed by the application. The disclosure of sensitive information may be possible. Under some circumstances, reports indicate that it may be possible to access and reply to arbitrary private messages. This issue has been reported in the 'member.php', 'misc.php' and 'pm.php' scripts.

Affected Products

Lokwa lokwa_bb

References

BugTraq: 4981

URL: http://online.securityfocus.com/archive/1/276032 http://lokwa.farcom.com/

Short Name

HTTP:PHP:LOKWABB-PRIVM3

Severity

Minor

Recommended

False

Recommended Action

None

HTTP: LokwaBB Private Message Disclosure (3)

Extended Description

Affected Products

References

Found a potential security threat?