2280 matches found
CVE-2008-7082
MyBB aka MyBulletinBoard 1.4.3 includes the sensitive mypostkey parameter in URLs to moderation.php with the 1 mergeposts, 2 split, and 3 deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery CSRF protection mechanism to hijack the...
CVE-2008-7082
CVE-2008-7082 affects MyBB 1.4.3, where the sensitive my_post_key token is exposed in URLs to moderation.php for actions (mergeposts, split, deleteposts). An attacker can read the token from the HTTP Referer header to bypass CSRF protection and hijack a moderator’s session/authentication. The sou...
CVE-2008-7082
MyBB aka MyBulletinBoard 1.4.3 includes the sensitive mypostkey parameter in URLs to moderation.php with the 1 mergeposts, 2 split, and 3 deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery CSRF protection mechanism to hijack the...
Sql injection
SQL injection vulnerability in inc/datahandlers/user.php in MyBB aka MyBulletinBoard before 1.4.7 allows remote authenticated users to execute arbitrary SQL commands via the birthdayprivacy parameter...
CVE-2009-2230
SQL injection vulnerability in inc/datahandlers/user.php in MyBB aka MyBulletinBoard before 1.4.7 allows remote authenticated users to execute arbitrary SQL commands via the birthdayprivacy parameter...
CVE-2009-2230
CVE-2009-2230 affects MyBB (MyBulletinBoard) prior to 1.4.7. The issue is an SQL injection in inc/datahandlers/user.php via the birthdayprivacy parameter, exploitable by remote authenticated users to run arbitrary SQL commands. The connected documents confirm the vulnerable component and the inje...
CVE-2009-2230
SQL injection vulnerability in inc/datahandlers/user.php in MyBB aka MyBulletinBoard before 1.4.7 allows remote authenticated users to execute arbitrary SQL commands via the birthdayprivacy parameter...
MyBB birthdayprivacy参数SQL注入漏洞
BUGTRAQ ID: 35458 MyBB是一款流行的Web论坛程序。 MyBB没有正确地验证用户请求中提交给inc/datahandlers/user.php模块的birthdayprivacy参数，远程攻击者可以通过向论坛提交恶意请求执行SQL注入攻击，导致获得论坛的管理权限。成功利用这个漏洞要求打开了Mybb的不可视模式且拥有有效的登录凭据。 MyBB 1.4.7 厂商补丁： MyBB ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
MyBB <= 1.4.6 Remote Code Execution Exploit
No description provided by source. ?PHP / Someone decided to contact mybb's staff informing about this vulnerability with the obvious result that this will not work anymore. Fucking moron. I'm releasing a non-finished version of the exploit. No help, PoC and with the necessity of --admindir flag...
MyBB 1.4.6 Code Execution
?PHP / Someone decided to contact mybb's staff informing about this vulnerability with the obvious result that this will not work anymore. Fucking moron. I'm releasing a non-finished version of the exploit. No help, PoC and with the necessity of --admindir flag. Going to update it in the next day...
MyBB <= 1.4.6 Remote Code Execution Exploit
Exploit for unknown platform in category web applications =========================================== MyBB = 1.4.6 Remote Code Execution Exploit =========================================== ?PHP / Someone decided to contact mybb's staff informing about this vulnerability with the obvious result th...
MyBB 1.4.6 - Remote Code Execution
MyBB 1.4.6 - Remote Code Execution ?PHP / Someone decided to contact mybb's staff informing about this vulnerability with the obvious result that this will not work anymore. Fucking moron. I'm releasing a non-finished version of the exploit. No help, PoC and with the necessity of --admindir flag...
MyBB 1.4.6 - Remote Code Execution
?PHP / Someone decided to contact mybb's staff informing about this vulnerability with the obvious result that this will not work anymore. Fucking moron. I'm releasing a non-finished version of the exploit. No help, PoC and with the necessity of --admindir flag. Going to update it in the next day...
MyBB 1.4.5 Cross Site Scripting
Advisory : Cross-Site Scripting vulnerability in MyBB Application: MyBB Vulnerable Versions: alert'xss' http://yourdomain.com/somefile.png must be a valid link to an image file meeting the board settings for avatars. Discussion The XSS renders in all browsers and on various pages inside the myB...
“Cross-Site Scripting” vulnerability in MyBB 1.4.5
Advisory : “Cross-Site Scripting” vulnerability in MyBB Application: MyBB Vulnerable Versions: = 1.4.5 Reported By: Jacques Copeau Description MyBB is a forum package full of useful and to-the-point features, helping you to make administrating your bulletin board as easy as possible. We highlight...
MyBB 1.4.5 - Multiple Vulnerabilities
MyBB 1.4.5 - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/34798/info MyBB is prone to multiple security vulnerabilities, including an HTML-injection issue and an unspecified issue. An attacker may leverage the HTML-injection issue to execute arbitrary script code in the...
MyBB 1.4.5 - Multiple Vulnerabilities
source: https://www.securityfocus.com/bid/34798/info MyBB is prone to multiple security vulnerabilities, including an HTML-injection issue and an unspecified issue. An attacker may leverage the HTML-injection issue to execute arbitrary script code in the browser of an unsuspecting user in the...
MyBB (FWS Mod) reflected XSS
MyBB FWS Mod reflected XSS Mod Name: Forum Warning System http://community.mybboard.net/attachment.php?aid=6814 Vulnerable piece of code: //USERCP AND PM CHANGES elseif$file == "usercp.php" || $file == "private.php" iffunctionexists"imagecreatefrompng" && $mybb-user'fwswarnings' != 0...
CVE-2008-6198
CVE-2008-6198 affects the Custom Pages 1.0 plugin for MyBulletinBoard (MyBB). The vulnerability is an SQL injection in pages.php via the page parameter, allowing remote attackers to execute arbitrary SQL commands. This is supported by multiple sources (NVD entry; CVE listing; PRION and CVELIST re...
