CVE-2007-2211

CVE-2007-2211 corresponds to a SQL injection in calendar.php of MyBB (MyBulletinBoard)

MyBB calendar.php脚本远程SQL注入漏洞

MyBB是一款流行的Web论坛程序。 MyBB的实现上存在输入验证漏洞，远程攻击者可能利用此漏洞非授权访问操作数据库。 MyBB的calendar.php脚本没有对year、month或day参数数据做充分的检查过滤，远程攻击者可以在输入数据中插入特定的SQL语句，导致攻击者浏览、添加或修改删除后端数据库中的信息。 MyBB MyBB = 1.2.5 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.mybboard.com/ http://www.sebug.net/show-exp-1760.html...

MyBulletinBoard (MyBB) <= 1.2.5 calendar.php Blind SQL Injection Exploit

No description provided by source. !/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 print " \n"; print " \n"; print " MyBulletinBoard = 1.2.5 Remote SQL Injection Exploit \n"; print " Bug found and Exploit coded by 0x86 \n"; print " \n"; print " www.geeksec.net \n"; print " 0x86 at...

MyBulletinBoard (MyBB) 1.2.2 - 'CLIENT-IP' SQL Injection

!/usr/bin/perl LOGO Mybb = 4.1 wwork: blind sql-inj ggoogle: Powered By MyBB coded by Elekt antichat.ru Coments Описание: Работа эксплойта основана на sql-инъекции в HTTPCLIENTIP. Неавторизованный пользователь может...

MyBulletinBoard (MyBB) 1.2.2 - CLIENT-IP SQL Injection

MyBulletinBoard MyBB 1.2.2 - CLIENT-IP SQL Injection !/usr/bin/perl LOGO Mybb = 4.1 wwork: blind sql-inj ggoogle: Powered By MyBB coded by Elekt antichat.ru Coments Описание: Работа эксплойта основана на sql-инъекции в HTTPCLIENTIP...

CVE-2007-1963

SQL injection vulnerability in the createsession function in classsession.php in MyBB aka MyBulletinBoard 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775...

Sql injection

SQL injection vulnerability in the createsession function in classsession.php in MyBB aka MyBulletinBoard 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775...

CVE-2007-1964

member.php in MyBB aka MyBulletinBoard, when debug mode is available, allows remote authenticated users to change the password of any account by providing the account's registered e-mail address in a debug request for a dolostpw action, which prints the change password verification code in the...

CVE-2007-1964

member.php in MyBB aka MyBulletinBoard, when debug mode is available, allows remote authenticated users to change the password of any account by providing the account's registered e-mail address in a debug request for a dolostpw action, which prints the change password verification code in the...

CVE-2007-1963

SQL injection vulnerability in the createsession function in classsession.php in MyBB aka MyBulletinBoard 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775...

Default credentials

member.php in MyBB aka MyBulletinBoard, when debug mode is available, allows remote authenticated users to change the password of any account by providing the account's registered e-mail address in a debug request for a dolostpw action, which prints the change password verification code in the...

CVE-2007-1964

member.php in MyBB aka MyBulletinBoard, when debug mode is available, allows remote authenticated users to change the password of any account by providing the account's registered e-mail address in a debug request for a dolostpw action, which prints the change password verification code in the...

CVE-2007-1963

CVE-2007-1963 describes an SQL injection in MyBB (MyBulletinBoard) up to version 1.2.3, exploitable through the Client-IP HTTP header in the create_session function of class_session.php. The vulnerability permits remote SQL commands and is a related issue to CVE-2006-3775. The initial description...

CVE-2007-1964

The CVE-2007-1964 issue affects MyBB (MyBulletinBoard) via member.php. When debug mode is enabled, remote authenticated users can change any account’s password by sending a do_lostpw request with the target’s registered email, and the debug output prints the change-password verification code. Acc...

CVE-2007-1963

SQL injection vulnerability in the createsession function in classsession.php in MyBB aka MyBulletinBoard 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775...

CVE-2007-1906

Directory traversal vulnerability in richedit/keyboard.php in eCardMAX HotEditor Hot Editor 4.0, and the HotEditor plugin for MyBB, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the first parameter...

Directory traversal

Directory traversal vulnerability in richedit/keyboard.php in eCardMAX HotEditor Hot Editor 4.0, and the HotEditor plugin for MyBB, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the first parameter...

eCardMAX HotEditor 4.0 - Keyboard.php Local File Inclusion

eCardMAX HotEditor 4.0 - Keyboard.php Local File Inclusion source: https://www.securityfocus.com/bid/23377/info eCardMAX HotEditor is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view...

eCardMAX HotEditor 4.0 - 'Keyboard.php' Local File Inclusion

source: https://www.securityfocus.com/bid/23377/info eCardMAX HotEditor is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view files and execute local scripts. HotEditor 4.0 is...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in MyBB aka MyBulletinBoard 1.2.2 allows remote attackers to send messages to arbitrary users. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...