Sql injection

Multiple unspecified vulnerabilities in MyBulletinBoard MyBB before 1.0.2 have unspecified impact and attack vectors, related to 1 admin/moderate.php, 2 admin/themes.php, 3 inc/functions.php, 4 inc/functionsupload.php, 5 printthread.php, and 6 usercp.php, and probably related to SQL injection...

CVE-2006-0219

The original distribution of MyBulletinBoard MyBB to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allows attackers to conduct 1 SQL injection attacks via an attachment name that is not properly handled by inc/functionsupload.php...

CVE-2006-0218

MyBB/MyBulletinBoard has multiple concrete issues in versions before 1.0.2, including CVE-2006-0218 (related to various files and likely SQL injection), CVE-2006-0219 (SQL injection via an attachment name and related threadmode issues in usercp.php), and CVE-2006-0442 (XSS in usercp.php). The fil...

MyBB 1.0.2 SQL injection in usercp.php

this is a bug report for MyBB 1.0.2latest version bug found by imei there is a security bug in usercp.php line 830 that Allows SQL Injection and can result to full access to admin cp. bug is in result of poor checking of $mybb-input'threadmode' value against all other values in usercp.php file...

[SA18281] MyBB Multiple Vulnerabilities

TITLE: MyBB Multiple Vulnerabilities SECUNIA ADVISORY ID: SA18281 VERIFY ADVISORY: http://secunia.com/advisories/18281/ CRITICAL: Moderately critical IMPACT: Unknown, Cross Site Scripting, Manipulation of data WHERE: From remote SOFTWARE: MyBB formerly MyBulletinBoard 1.x...

CVE-2005-4602

SQL injection vulnerability in inc/functionupload.php in MyBB before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the file extension of an uploaded file attachment...

CVE-2005-4603

The CVE-2005-4603 entry describes a Cross-site scripting (XSS) vulnerability in printthread.php of MyBB versions 1.0.1 and earlier. The issue arises because thread messages are not properly sanitized in the print view, allowing remote attackers to inject arbitrary web script or HTML via the threa...

MyBB < 1.01 function_upload.php SQLi

The version of MyBB installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the to the file extension of an uploaded file. A remote, unauthenticated attacker can exploit this issue to manipulate SQL queries, resulting in the...

CVE-2005-4602

CVE-2005-4602 relates to MyBB before 1.0.1, where an SQL injection vulnerability exists in inc/functions_upload.php that can be exploited via the file extension of an uploaded attachment to execute arbitrary SQL. Evidence in connected records confirms this issue and links it to later notes that M...

CVE-2005-4603

Cross-site scripting XSS vulnerability in printthread.php in MyBB 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a thread message, which is not properly sanitized in the print view of the thread...

CVE-2005-4602

SQL injection vulnerability in inc/functionupload.php in MyBB before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the file extension of an uploaded file attachment...

CVE-2005-4603

Cross-site scripting XSS vulnerability in printthread.php in MyBB 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a thread message, which is not properly sanitized in the print view of the thread...

MyBB 1.0 SQL injection in uploading file

Hey there is a security bug in inc/functionupload.php script in mybb all version except two days ago security updated version that allows SQL INJECTION this bug is in function of upload attachment . when a file goes to upload this function test that if file has a valid extension . for this call...

MyBB XSS cross-site scripting

Hey this is a security bug in printthread.PHP script of MyBBall version also fully patched that allows XSS crosssite scripting hacking and can be exploit without limitation. post this message on a thread and go to print view of thread to view execution of exploit. script...

MyBB 1.0 - Globa.php Cookie Data SQL Injection

MyBB 1.0 - Globa.php Cookie Data SQL Injection source: https://www.securityfocus.com/bid/16082/info MyBB is prone to an SQL injection vulnerability. The vulnerability presents itself when user-supplied input via cookie data is passed to the 'admin/globa.php' script. Successful exploitation can...

MyBB 1.0 - 'Globa.php' Cookie Data SQL Injection

source: https://www.securityfocus.com/bid/16082/info MyBB is prone to an SQL injection vulnerability. The vulnerability presents itself when user-supplied input via cookie data is passed to the 'admin/globa.php' script. Successful exploitation can allow an attacker to bypass authentication and ga...

[TKADV2005-12-001] Multiple SQL Injection vulnerabilities in MyBB

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory: Multiple SQL Injection vulnerabilities in MyBB Name: TKADV2005-12-001 Revision: 1.0 Release Date: 2005/12/23 Last Modified: 2005/12/23 Date Reported: 2005/11/07 Author: Tobias Klein tk at trapkit.de Affected Software: MyBB all versions = MyB...

MyBB 1.0.2 - Multiple Cross-Site Scripting Vulnerabilities

MyBB 1.0.2 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/16387/info MyBB is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. An attacker may leverage this issue to have...

MyBB 1.0.2 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/16387/info MyBB is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an...

MyBB calendar.php 'month' Parameter SQLi

The version of MyBB installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'month' parameter of the calendar.php script. A remote, unauthenticated attacker can exploit this issue to manipulate SQL queries, resulting in...