header-logo
Suggest Exploit
vendor:
Gender Mod
by:
Unknown
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Gender Mod
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested: Unix, Linux, and Windows
Unknown

phpBB2 Gender Mod SQL Injection Vulnerability

The Gender Mod for phpBB2 allows a remote user to manipulate the SQL statement used to update their user profile, potentially gaining administrative access to the system.

Mitigation:

Upgrade to a patched version of the Gender Mod or remove the mod from the phpBB2 installation.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5342/info

phpBB2 is an open-source web forum application that is written in PHP and backended by a number of database products. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

Gender Mod is a modification for phpBB2 which allows the association of a gender with a given user profile. A SQL injection vulnerability has been reported in this mod. A remote user may subvert the SQL statement used to update their user profile, possibly gaining administrative access to the system. 

"0, user_level = 1 "

Navigation

Suggest Exploit

Services By CQR