CVE-2014-10029
HighSummary
CVE-2014-10029 is a SQL injection vulnerability in profile.php in FluxBB before version 1.4.13 and 1.5.x before version 1.5.7. It allows remote attackers to execute arbitrary SQL commands via the req_new_email parameter.
Risk Assessment
Attackers can exploit this vulnerability to gain control over the database, potentially leading to the exposure of sensitive data or deletion of information. Organizations should be aware of the potential consequences related to data security.
Recommendation
It is recommended to update FluxBB to the latest version to eliminate this vulnerability. Additionally, conducting a security audit of the application to identify other potential vulnerabilities is advisable.
Other vulnerabilities in FluxBB
See all- CVE-2014-9574High
Directory traversal vulnerability in install.php in FluxBB before 1.5.8 allows remote attackers to include and execute arbitrary local install.php files via a .. (dot dot) in the install_lang parameter.
- CVE-2021-43677Medium
Fluxbb version 1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. This allows an attacker to inject malicious JavaScript code into pages viewed by other users.
- CVE-2020-28873High
Fluxbb 1.5.11 is vulnerable to a denial of service (DoS) attack by sending an extremely long password via the login form. The password hashing process exhausts CPU and memory resources on the server.
Original NVD description (English source)
SQL injection vulnerability in profile.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to execute arbitrary SQL commands via the req_new_email parameter.