[myimei]MyBB 1.0.2 XSS attack in search.php

original advisory: http://myimei.com/security/2006-01-14-mybb-102searchphpxss-attackandmore/index.html --------------- —————-Summary—————- Software: MyBB Sowtware’s Web Site: http://mybboard.com Versions: 1.0.2 Class: Remote Status: patched in 1.0.3 Exploit: Available Solution: Available Discover...

MyBB 1.0.3 - 'moderation.php' SQL Injection

source: https://www.securityfocus.com/bid/16538/info MyBB is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input. Successful exploitation can allow an attacker to bypass authentication and gain administrative access to a site, modify data...

MyBB 1.0.3 - moderation.php SQL Injection

MyBB 1.0.3 - moderation.php SQL Injection source: https://www.securityfocus.com/bid/16538/info MyBB is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input. Successful exploitation can allow an attacker to bypass authentication and gain...

MyBB Detection

The remote host is running MyBB formerly known as MyBulletinBoard, a web-based bulletin board system written in PHP utilizing MySQL for its back-end storage. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid20841; scriptversion"1.21";...

Sql injection

SQL injection vulnerability in global.php in MyBB before 1.03 allows remote attackers to execute arbitrary SQL commands via the templatelist variable...

CVE-2006-0523

The vulnerability CVE-2006-0523 is an SQL injection flaw in MyBB’s global.php (templatelist variable) affecting versions prior to 1.03. The issue allows remote attackers to modify SQL queries, potentially compromising data. The core detail is that templatelist input is used in SQL statements with...

CVE-2006-0523

SQL injection vulnerability in global.php in MyBB before 1.03 allows remote attackers to execute arbitrary SQL commands via the templatelist variable...

MyBB index.php 'referrer' Parameter SQLi

The version of MyBB installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'referrer' parameter before using it in the globals.php script. A remote attacker can exploit this issue to manipulate SQL queries, resulting in...

Directory traversal

Directory traversal vulnerability in MyBB aka MyBulletinBoard 1.02 allows local users with MyBB administrative privileges to include and possibly execute arbitrary local files via directory traversal sequences and a nul %00 character in the plugin parameter...

CVE-2006-0494

Directory traversal vulnerability in MyBB aka MyBulletinBoard 1.02 allows local users with MyBB administrative privileges to include and possibly execute arbitrary local files via directory traversal sequences and a nul %00 character in the plugin parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the Add Thread to Favorites feature in usercp2.php in MyBB aka MyBulletinBoard 1.02 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header $url variable...

CVE-2006-0495

Cross-site scripting XSS vulnerability in the Add Thread to Favorites feature in usercp2.php in MyBB aka MyBulletinBoard 1.02 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header $url variable...

CVE-2006-0495

The CVE-2006-0495 entry concerns MyBB (MyBulletinBoard) 1.02. A Cross‑Site Scripting (XSS) flaw exists in the Add Thread to Favorites feature implemented in usercp2.php, exploitable via an HTTP Referer header (the $url variable). This allows remote attackers to inject arbitrary web script or HTML...

CVE-2006-0494

Directory traversal vulnerability in MyBB aka MyBulletinBoard 1.02 allows local users with MyBB administrative privileges to include and possibly execute arbitrary local files via directory traversal sequences and a nul %00 character in the plugin parameter...

CVE-2006-0495

Cross-site scripting XSS vulnerability in the Add Thread to Favorites feature in usercp2.php in MyBB aka MyBulletinBoard 1.02 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header $url variable...

CVE-2006-0494

CVE-2006-0494 : The connected NVD entry describes a directory traversal vulnerability in MyBB (MyBulletinBoard) 1.02. Local users with MyBB administrative privileges can include and possibly execute arbitrary local files via directory traversal sequences and a nul (%00) character in the plugin pa...

CVE-2006-0470

CVE-2006-0470 describes an XSS vulnerability in MyBB 1.02’s search.php where the sortby and sortordr parameters are not properly handled during redirection. An attacker could inject arbitrary script/HTML by manipulating these parameters, leading to possible remote script execution in the context ...

MyBB 1.0/1.1 - 'index.php' Referrer Cookie SQL Injection

source: https://www.securityfocus.com/bid/16443/info MyBB is prone to an SQL-injection vulnerability. The vulnerability presents itself when user-supplied input via cookie data is passed to the 'index.php' script. Successful exploitation can allow an attacker to bypass authentication and gain...

MyBB 1.01.1 - index.php Referrer Cookie SQL Injection

MyBB 1.01.1 - index.php Referrer Cookie SQL Injection source: https://www.securityfocus.com/bid/16443/info MyBB is prone to an SQL-injection vulnerability. The vulnerability presents itself when user-supplied input via cookie data is passed to the 'index.php' script. Successful exploitation can...

MyBB 1.2 Local File Incusion

Invalid characters removed from From: [email protected], |@securityfocus.com, D3vil-0x1 MyBB Bug Local File Inclusion MyBB 1.2 - Admin Can Include Local File : File :- admin/plugins.php Line :- 51 // if$mybb-input'action' == "activate" $codename = $mybb-input'plugin'; Input From POST $file =...