CVE-2007-2211

CVE-2007-2211 corresponds to a SQL injection in calendar.php of MyBB (MyBulletinBoard)

MyBB calendar.php脚本远程SQL注入漏洞

MyBB是一款流行的Web论坛程序。 MyBB的实现上存在输入验证漏洞，远程攻击者可能利用此漏洞非授权访问操作数据库。 MyBB的calendar.php脚本没有对year、month或day参数数据做充分的检查过滤，远程攻击者可以在输入数据中插入特定的SQL语句，导致攻击者浏览、添加或修改删除后端数据库中的信息。 MyBB MyBB = 1.2.5 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.mybboard.com/ http://www.sebug.net/show-exp-1760.html...

MyBulletinBoard (MyBB) <= 1.2.5 calendar.php Blind SQL Injection Exploit

No description provided by source. !/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 print " \n"; print " \n"; print " MyBulletinBoard = 1.2.5 Remote SQL Injection Exploit \n"; print " Bug found and Exploit coded by 0x86 \n"; print " \n"; print " www.geeksec.net \n"; print " 0x86 at...

MyBulletinBoard (MyBB) 1.2.2 - 'CLIENT-IP' SQL Injection

!/usr/bin/perl LOGO Mybb = 4.1 wwork: blind sql-inj ggoogle: Powered By MyBB coded by Elekt antichat.ru Coments Описание: Работа эксплойта основана на sql-инъекции в HTTPCLIENTIP. Неавторизованный пользователь может...

MyBulletinBoard (MyBB) 1.2.2 - CLIENT-IP SQL Injection

MyBulletinBoard MyBB 1.2.2 - CLIENT-IP SQL Injection !/usr/bin/perl LOGO Mybb = 4.1 wwork: blind sql-inj ggoogle: Powered By MyBB coded by Elekt antichat.ru Coments Описание: Работа эксплойта основана на sql-инъекции в HTTPCLIENTIP...

CVE-2007-1963

SQL injection vulnerability in the createsession function in classsession.php in MyBB aka MyBulletinBoard 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775...

Sql injection

SQL injection vulnerability in the createsession function in classsession.php in MyBB aka MyBulletinBoard 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775...

CVE-2007-1964

member.php in MyBB aka MyBulletinBoard, when debug mode is available, allows remote authenticated users to change the password of any account by providing the account's registered e-mail address in a debug request for a dolostpw action, which prints the change password verification code in the...

CVE-2007-1963

SQL injection vulnerability in the createsession function in classsession.php in MyBB aka MyBulletinBoard 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775...

CVE-2007-1964

member.php in MyBB aka MyBulletinBoard, when debug mode is available, allows remote authenticated users to change the password of any account by providing the account's registered e-mail address in a debug request for a dolostpw action, which prints the change password verification code in the...

Default credentials

member.php in MyBB aka MyBulletinBoard, when debug mode is available, allows remote authenticated users to change the password of any account by providing the account's registered e-mail address in a debug request for a dolostpw action, which prints the change password verification code in the...

CVE-2007-1964

member.php in MyBB aka MyBulletinBoard, when debug mode is available, allows remote authenticated users to change the password of any account by providing the account's registered e-mail address in a debug request for a dolostpw action, which prints the change password verification code in the...

CVE-2007-1963

CVE-2007-1963 describes an SQL injection in MyBB (MyBulletinBoard) up to version 1.2.3, exploitable through the Client-IP HTTP header in the create_session function of class_session.php. The vulnerability permits remote SQL commands and is a related issue to CVE-2006-3775. The initial description...

CVE-2007-1963

SQL injection vulnerability in the createsession function in classsession.php in MyBB aka MyBulletinBoard 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775...

CVE-2007-1964

The CVE-2007-1964 issue affects MyBB (MyBulletinBoard) via member.php. When debug mode is enabled, remote authenticated users can change any account’s password by sending a do_lostpw request with the target’s registered email, and the debug output prints the change-password verification code. Acc...

CVE-2007-1906

Directory traversal vulnerability in richedit/keyboard.php in eCardMAX HotEditor Hot Editor 4.0, and the HotEditor plugin for MyBB, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the first parameter...

Directory traversal

Directory traversal vulnerability in richedit/keyboard.php in eCardMAX HotEditor Hot Editor 4.0, and the HotEditor plugin for MyBB, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the first parameter...

eCardMAX HotEditor 4.0 - Keyboard.php Local File Inclusion

eCardMAX HotEditor 4.0 - Keyboard.php Local File Inclusion source: https://www.securityfocus.com/bid/23377/info eCardMAX HotEditor is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view...

eCardMAX HotEditor 4.0 - 'Keyboard.php' Local File Inclusion

source: https://www.securityfocus.com/bid/23377/info eCardMAX HotEditor is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view files and execute local scripts. HotEditor 4.0 is...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in MyBB aka MyBulletinBoard 1.2.2 allows remote attackers to send messages to arbitrary users. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...