Description
Post.pl in YaBB 1 Gold SP 1.2 allows remote attackers to modify records in the board's .txt file via carriage return characters in the subject field.
References
- http://www.yabbforum.com/community/YaBB.pl?board=general%3Baction=display%3Bnum=1093133233
- yabb-subject-modify-file(16050) vdb-entry
- 12609 third-party-advisory
- 10263 vdb-entry
- 20040502 Vulnerability in YaBB forum (Perl version without SQL) mailing-list