CVE-2006-1345

polls.php in MyBB aka MyBulletinBoard 1.10 allows remote attackers to obtain sensitive information via a vote action with an "option=null" parameter value, which reveals the path in an error message...

CVE-2006-1345

CVE-2006-1345 affects MyBB (MyBulletinBoard) 1.10 in polls.php. A vote action using option[]=null can trigger an error message that exposes the server path, enabling information disclosure. The vulnerability is described as a remote information exposure due to an error response, with affected pro...

CVE-2006-1281

Cross-site scripting XSS vulnerability in member.php in MyBulletinBoard MyBB 1.04 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vulnerability than CVE-2006-1272. NOTE: 1.10 was later reported to be vulnerable...

CVE-2006-1281

The CVE-2006-1281 entry concerns a Cross-Site Scripting (XSS) vulnerability in MyBulletinBoard (MyBB) 1.04. The flaw exists in member.php and allows remote attackers to inject arbitrary web script or HTML via the url parameter. The vulnerability is documented as distinct from CVE-2006-1272, with ...

CVE-2006-1281

Cross-site scripting XSS vulnerability in member.php in MyBulletinBoard MyBB 1.04 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vulnerability than CVE-2006-1272. NOTE: 1.10 was later reported to be vulnerable...

CVE-2006-1282

CVE-2006-1282 affects MyBB (MyBulletinBoard) 1.04 with a CRLF injection in inc/function.php that enables remote attackers to perform XSS, cache poisoning, or page hijacking via CRLF (%0A%0D) sequences in the Referrer header, possibly during redirects. Connected sources confirm the vulnerability d...

CVE-2006-1272

MyBB 1.0.3 contains multiple XSS vulnerabilities in member.php, exploitable via the fields aim, yahoo, msn, and website. Root cause: insufficient input sanitization in these fields leading to script or HTML injection, as described across CVE-2006-1272 entries. Document set does not include remedi...

MyBB 1.10 Full Path Disclosure

D3vil-0x1 | Devil-00 New MyBB bug that will giv you the ' Full Path Disclosure ' at vic. server MyBB 1.10 .. New Bugs 1- Full Path Disclosure = mybb/polls.php?action=vote&pid=PID&option=null - Where PID Poll ID...

[KAPDA::#35] - MyBB1.0.4~member.php~XSS after login

ORIGINAL ADVISORY: http://myimei.com/security/2006-03-09/mybb104memberphpxss-after-login.html http://kapda.ir/advisory-296.html ——–Summary——– Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.0.4 Class: Remote Status: Unpatched Exploit: Available Solution: Available Discover...

[KAPDA::#34] - MyBB1.0.4~redirectfunction()~HeaderInjection

ORIGINAL ADVISORY: http://myimei.com/security/2006-03-10/mybb104redirectfunctionheaderinjection.html http://kapda.ir/advisory-295.html ——–Summary——– Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.0.4 Class: Remote Status: Unpatched Exploit: Not Available Solution: Availab...

[[KAPDA::#35] MyBB 1.0.3~member.php~XSS Attack in contact details

ORIGINAL ADVISORY: http://myimei.com/security/2006-03-11/mybb-103-memberphp-xss-attack-in-contact-details.html http://kapda.ir/advisory-297.html ——————-Summary—————- Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.0.4 Class: Remote Status: Unpatched Exploit: Available...

MyBB 'comma' Cookie SQLi

The version of MyBB installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'comma' cookie used by several scripts. A remote attacker can exploit this issue to manipulate SQL queries, resulting in the disclosure of...

MyBB search.php 'forums' Parameter SQLi

The version of MyBB running on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'forums' parameter of the search.php script. A remote attacker can exploit this issue to manipulate SQL queries, resulting in the disclosure of...

CVE-2006-1065

The CVE-2006-1065 entry concerns MyBB 1.04, specifically a vulnerability in search.php where the forums[] parameter enables SQL injection. The issue is triggered by unsanitized user input, allowing a remote attacker to manipulate SQL queries and potentially view or modify data. The connected Ness...

MyBB-104SQL.txt

MyBB 1.0.4 New SQL Injection D3vil-0x1 File :- search.php 580 to 592 / START / if$mybb-input'forums' != "all" if!isarray$mybb-input'forums' input'forums' = arrayintval$mybb-input'forums'; foreach$mybb-input'forums' as $forum if!$searchin$forum $query = $db-query"SELECT f.fid FROM...

MyBB104SQL.txt

!/usr/bin/perl -w MyBB : DONT FORGET TO DO YOUR CONFIG !! DONT FORGET TO DO YOUR CONFIG !! DONT FORGET TO DO YOUR CONFIG !! use IO::Socket; -- Start -- $host = "127.0.0.1"; $path = "/mybb3/"; $userid = 1; $mycookie = "mybbuser=1xommhw5h9kZZGSFUppacVfacykK1gnd84PLehjlhTGC1ZiQkXr;"; -- END -- $host...

MyBulletinBoard (MyBB) 1.04 - 'misc.php' SQL Injection (2)

!/usr/bin/perl -w MyBB : DONT FORGET TO DO YOUR CONFIG !! DONT FORGET TO DO YOUR CONFIG !! DONT FORGET TO DO YOUR CONFIG !! use IO::Socket; -- Start -- $host = "127.0.0.1"; $path = "/mybb3/"; $userid = 1; $mycookie = "mybbuser=1xommhw5h9kZZGSFUppacVfacykK1gnd84PLehjlhTGC1ZiQkXr;"; -- END -- $host...

MyBB 1.0.4 New SQL Injection

MyBB 1.0.4 New SQL Injection D3vil-0x1 File :- search.php 580 to 592 / START / if$mybb-input'forums' != "all" if!isarray$mybb-input'forums' -- We Break It By forums=-1 $mybb-input'forums' = arrayintval$mybb-input'forums'; foreach$mybb-input'forums' as $forum if!$searchin$forum $query =...

MyBulletinBoard (MyBB) <= 1.04 (misc.php COMMA) SQL Injection (2)

Exploit for unknown platform in category web applications ================================================================= MyBulletinBoard MyBB : DONT FORGET TO DO YOUR CONFIG !! DONT FORGET TO DO YOUR CONFIG !! DONT FORGET TO DO YOUR CONFIG !! use IO::Socket; -- Start -- $host = "127.0.0.1";...

MyBulletinBoard (MyBB) 1.04 - misc.php SQL Injection (2)

MyBulletinBoard MyBB 1.04 - misc.php SQL Injection 2 !/usr/bin/perl -w MyBB : DONT FORGET TO DO YOUR CONFIG !! DONT FORGET TO DO YOUR CONFIG !! DONT FORGET TO DO YOUR CONFIG !! use IO::Socket; -- Start -- $host = "127.0.0.1"; $path = "/mybb3/"; $userid = 1; $mycookie =...