CVE-2013-6936

CVE-2013-6936 describes multiple SQL injection vulnerabilities in the Ajaxfs plugin (MyBB), specifically in ajaxfs.php via the tooltip and usertooltip parameters in the Ajax forum stat plugin 2.0. Remote attackers could execute arbitrary SQL commands. OpenVAS notes a WillNotFix remediation.

CVE-2013-6936: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat Ajaxfs Plugin 2.0 for MyBB aka MyBulletinBoard allow remote attackers to execute arbitrary SQL commands via the 1 tooltip or 2 usertooltip parameter...