CVEvulnerability

CVE-2006-3994

7.5 HIGH Published 2006-08-05 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2006-08-05
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

SQL injection vulnerability in the u2u_send_recp function in u2u.inc.php in XMB (aka extreme message board) 1.9.6 Alpha and earlier allows remote attackers to execute arbitrary SQL commands via the u2uid parameter to u2u.php, which is directly accessed from $_POST and bypasses the protection scheme.

Affected configurations

• xmb software xmb forum (<= 1.9.6 alpha)

References

http://secunia.com/advisories/21293 Vendor Advisory
http://www.securityfocus.com/bid/19280 Exploit
http://www.vupen.com/english/advisories/2006/3088 www.vupen.com
https://docs.xmbforum2.com/index.php?title=Security_Issue_History docs.xmbforum2.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/28159 exchange.xforce.ibmcloud.com
https://www.exploit-db.com/exploits/2105 www.exploit-db.com
http://secunia.com/advisories/21293 Vendor Advisory
http://www.securityfocus.com/bid/19280 Exploit
http://www.vupen.com/english/advisories/2006/3088 www.vupen.com
https://docs.xmbforum2.com/index.php?title=Security_Issue_History docs.xmbforum2.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/28159 exchange.xforce.ibmcloud.com
https://www.exploit-db.com/exploits/2105 www.exploit-db.com