CVE-2005-4200

MyBB before 1.0 contains multiple SQL injection vulnerabilities (CVE-2005-4199 and CVE-2005-4200) across calendar.php, usercp.php, member.php, showthread.php/ratethread.php, and related actions. Root cause: improper sanitization of user-supplied input in various parameters (e.g., calendar.php mon...

CVE-2005-4199

MyBB prior to 1.0 is affected by multiple SQL injection vulnerabilities. The public details identify concrete vectors, notably the month parameter in calendar.php (SQLi), and additional parameters in usercp.php, member.php, and showthread/ratethread.php. This is a documented remote, unauthenticat...

[TKPN2005-12-001] Multiple critical vulnerabilities in MyBB

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patch Notification: Multiple critical vulnerabilities in MyBB Name: TKPN2005-12-001 Revision: 1.0 Release Date: 2005/12/09 Last Modified: 2005/12/09 Date Reported: 2005/11/07 Author: Tobias Klein tk at trapkit.de Affected Software: MyBB all versions =...

CVE-2005-3776

Multiple cross-site scripting XSS vulnerabilities in MyBulletinBoard MyBB 1.0 PR2 Rev 686 allow remote attackers to inject arbitrary web script or HTML via 1 the subject field when creating a new thread and 2 information passed to the Reputation system...

CVE-2005-3777

MyBB 1.0 PR2 Rev 686 is affected by a vulnerability that allows remote attackers to delete or move private messages (PM) by submitting modified fields in the inbox form. The provided documents confirm the affected software and the manipulation vector, but do not specify root cause details beyond ...

CVE-2005-3778

The CVE-2005-3778 entry concerns MyBulletinBoard (MyBB) before 1.0 PR2 Rev 686. The vulnerability is described as an unspecified DoS achievable via unknown vectors, affecting the affected component and resulting in partial availability impact. Connected sources confirm the product and version ran...

CVE-2005-3778

Unspecified vulnerability in MyBulletinBoard MyBB before 1.0 PR2 Rev 686 allows attackers to cause a denial of service via unknown vectors...

CVE-2005-3776

CVE-2005-3776 affects MyBulletinBoard (MyBB) 1.0 PR2 Rev 686 with XSS vulnerabilities in (1) the thread creation subject and (2) the Reputation system input. The root cause is provided as multiple XSS flaws allowing remote attackers to inject arbitrary script/HTML; specifics on versions, affected...

CVE-2005-3326

The CVE-2005-3326 entry concerns MyBulletinBoard (MyBB) where SQL injection is possible in usercp.php via the awayday parameter, enabling remote SQL commands. Affected software: MyBB/MyBulletinBoard; vulnerable component: usercp.php (likely parameter handling). Underlying cause: unvalidated input...

mybbpr2.pl.txt

Vendor: www.mybboard.com Version: 1.00 Preview Release 2, RC4 and mayb prior. Script: usercp.php Code: if$mybb-input'away' == "yes" && $mybb-settings'allowaway' != "no" ... $returndate = $mybb-input'awayday'."-".$mybb-input'awaymonth'."-".$mybb-input'awayyear'; ... $newprofile = array "website" =...

MyBB misc.php Multiple SQL Injection Vulnerabilities

The version of MyBB installed on the remote host is affected by multiple SQL injection vulnerabilities due to improper sanitization of user-supplied input to the 'fid' parameter of the 'misc.php' script and the 'Content-Disposition' field in the HTTP header to the newreply.php script. A remote...

MyBB ratethread.php 'rating' Parameter SQLi

The version of MyBB installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'rating' parameter of the ratethread.php script. A remote attacker can exploit this issue to manipulate SQL queries, resulting in the disclosure...

CVE-2005-2888

CVE-2005-2888 affects MyBulletinBoard (MyBB) Preview Release 2. The vulnerability lies in two injection vectors: (1) the fid parameter of misc.php and (2) the Content-Disposition header in the HTTP request to newreply.php, due to improper sanitization of user-supplied input. An attacker remotely ...

[Full-disclosure] XSS VULN IN ALL MYBB VERSIONS (INCLUDING PR2)

XSS VULN IN ALL MYBB VERSIONS INCLUDING PR2 Vendor: given SEVEN days notice, no patch released! Just to say, I am apalled with the fact that I contacted MyBB on the 30 August, and was originally not planning to go public. However, because they have failed to release a patch I have decided to aler...

CVE-2005-2778

SQL injection vulnerability in member.php in MyBulletinBoard MyBB allows remote attackers to execute arbitrary SQL statements via the fid parameter...

CVE-2005-2778

The CVE-2005-2778 entry details a SQL injection in MyBulletinBoard (MyBB), specifically in member.php through the fid parameter. A remote attacker can craft input via fid to execute arbitrary SQL statements, with network access and no authentication required (low attack complexity). Affected soft...

mybbSQL.pl.txt

!/usr/bin/perl -w use LWP::Simple; Vitem if!$ARGV0 print " MyBB Member.php SQL Injection \n"; print " Coded By \n"; print " \n"; print " + Bug By W7ED - W7EDathotmail.com \n"; print " \n"; print " Exmp:- perl file.pl mybb.net /mybb userid \n"; print " \n"; exit; my $host = 'http://'.$ARGV0; User ...

MyBB <= 1.00 RC4 Multiple SQL Injection Vulnerabilities

The version of MyBB installed on the remote host is affected by multiple SQL injection vulnerabilities : - Multiple SQL injection vulnerabilities exist due to improper sanitization of user-supplied input passed via the 'Username' field, the 'action' parameter, and the 'polloptions' parameter. A...

MyBB - 'member.php' SQL Injection

source: https://www.securityfocus.com/bid/14684/info MyBB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. Successful exploitation could result in a compromise of the application, disclosure or modification of...

CVE-2005-2697

SQL injection vulnerability in search.php for MyBulletinBoard MyBB 1.00 Release Candidate 1 through 4 allows remote attackers to execute arbitrary SQL commands via the uid parameter. NOTE: this issue might overlap CVE-2005-0282...