CVE-2012-5909

2012-11-1721:00:00

mitre

www.cve.org

AI Score

8.3

Confidence

Low

EPSS

0.001

Percentile

34.1%

JSON

SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditions[usergroup][] parameter in a search action to admin/index.php.

References

osvdb.org/80634

packetstormsecurity.org/files/111238/MyBB-1.6.6-Cross-Site-Scripting-SQL-Injection.html

www.securityfocus.com/bid/52743

exchange.xforce.ibmcloud.com/vulnerabilities/74396