Re: CVE request: Four issues in PunBB

["Steven M. Christey" <coley () linus mitre org>]

Three CVE's are assigned because the two SQL injections also affect the
same product versions.

- Steve

======================================================
Name: CVE-2008-5433
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5433
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#possible_xss_in_login

Cross-site scripting (XSS) vulnerability in login.php in PunBB 1.3 and
1.3.1 allows remote attackers to inject arbitrary web script or HTML
via the password field.


======================================================
Name: CVE-2008-5434
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5434
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_at_adminusers.php_page
Reference: 
CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_in_adminsettings.php_via_configuration_values

Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow
remote authenticated administrators to execute arbitrary SQL commands
via the (1) order_by or (2) direction parameter to admin/users.php, or
(3) configuration options to admin/settings.php.


======================================================
Name: CVE-2008-5435
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5435
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/

Cross-site scripting (XSS) vulnerability in moderate.php in PunBB
before 1.3.1 allows remote attackers to inject arbitrary web script or
HTML via a topic subject.