YaBB Forum:
Find a Lawyer Discussion Deck
If ye would like to moderate the Find a Lawyer Discussion Deck, please drop becket@jollyroger.com a
line.
Find a Lawyer & YaBB Forum
[Open Source CMS
Renaissance][Postnuke Hosting][Gallery
Hosting][Blog Hosting]
DR. ELLIOT'S NORTH AMERICAN GREAT BOOKS TOUR--COMING TO A BOOK
STORE NEAR YOU
[GREAT
BOOKS: DISCUSS THE
TRAGEDY OF DRAKERAFT.COM][Great Books Lovers Match]
[Physics Forums][Poetry][Shakespeare's Plays][Great Books][Open Source Business]
[Great Books Games][Federalist Papers][Poetry Contest][Classic eCards][Great Books
Forums]
The new Find a Lawyer Forum is at
killdevilhill.com/philosophyforums.
The
World's Largest Literary Cafe: Carolinanavy.com
[Carolinanavy.com][Nantuckets.com][BusinessPhilosophy.com][Classicals.com][Quarterdeck]
[
Jolly Roger Live
Chat][The Jolly
Roger][KillDevilHill.com][Western Canon University]
[Federalistnavy.com Spirit of
America][Starbuck.com Classical Poetry Port]
[ussconstitutions.com]
[Free jollyrogermail]
[Shakespearean
Greetings]
[nantucketnavy.com][hatteraslight.com][Classicgreetings.com]
[SEARCH]
[Follow Ups][Post Followup][Find a Lawyer Forum Frigate]
[]
[The
World's Largest Literary Cafe: Carolinanavy.com]
Posted by Bill Russel on May 03, 19104 at 17:08:26:
There's a vulnerability in non-SQL version of YaBB forum (I've checked it with YaBB 1 Gold - SP 1.2 written in Perl -- it's not new, but is in use even nowadays). You can input almost anything into .txt file from boards directory. The "subject" form field isn't checked for "\n" symbols, so creating of a thread with such subject: "test of vulnerability" will add to the current board .txt file these strings
Follow Ups:
Post a Followup