Ubbcentral UBB.threads up to 7.6 Loginname cross site scripting

Summaryinfo

A vulnerability has been found in Ubbcentral UBB.threads and classified as problematic. Affected by this issue is some unknown functionality. Performing a manipulation of the argument Loginname results in cross site scripting. This vulnerability is known as CVE-2012-5104. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in Ubbcentral UBB.threads. This affects an unknown part. The manipulation of the argument Loginname with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

Cross-site scripting (XSS) vulnerability in forums/ubbthreads.php in UBB.threads 7.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the Loginname parameter.

The weakness was published 09/23/2012 with Sony (Website). It is possible to read the advisory at securityfocus.com. This vulnerability is uniquely identified as CVE-2012-5104 since 09/23/2012. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The exploit is shared for download at securityfocus.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (72147), Exploit-DB (36497), SecurityFocus (BID 51275†), OSVDB (78192†) and Secunia (SA47452†). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Ubbcentral

Name

• UBB.threads

Version

• 3.4
• 3.5
• 5.0
• 5.5.1
• 6.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.1
• 6.1.1
• 6.2
• 6.2.1
• 6.2.2
• 6.2.3
• 6.3
• 6.3.1
• 6.4
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4
• 6.5
• 6.5.1
• 6.5.1.1
• 6.5.2
• 6.5.2 Beta2
• 6.5.3
• 7.0
• 7.1
• 7.2
• 7.3.1
• 7.4
• 7.4.1
• 7.4.2
• 7.5
• 7.5.1
• 7.5.2
• 7.5.3
• 7.5.4
• 7.5.5
• 7.5.6
• 7.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion