Vulnerability CVE-2005-4199
Published: 2005-12-13   Modified: 2012-02-12

Description:
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options action in usercp.php; (6) list parameter in an editlists action to usercp.php; (7) rating parameter in a rate action in member.php; and (8) rating parameter in either showthread.php or ratethread.php.

See advisories in our WLB2 database:
Topic
Author
Date
High
Multiple critical vulnerabilities in MyBB
Tobias Klein
11.12.2005
Med.
Multiple SQL Injection vulnerabilities in MyBB
Tobias Klein
24.12.2005

Type:

CWE-89

 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
MYBB -> MYBB 

 References:
http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0379.html
http://community.mybboard.net/showthread.php?tid=5184&pid=30964#pid30964
http://securityreason.com/securityalert/246
http://securityreason.com/securityalert/294
http://securitytracker.com/id?1015407
http://www.securityfocus.com/archive/1/419067/100/0/threaded
http://www.securityfocus.com/archive/1/420159/100/0/threaded
http://www.securityfocus.com/bid/15793
http://www.trapkit.de/advisories/TKADV2005-12-001.txt
http://www.trapkit.de/advisories/TKPN2005-12-001.txt
http://www.vupen.com/english/advisories/2005/2842
Copyright 2024, cxsecurity.com

 

Back to Top