MyBulletinBoard (MyBB) 1.2.11 - private.php SQL Injection (1)

MyBulletinBoard MyBB 1.2.11 - private.php SQL Injection 1 !/usr/bin/perl MyBB =4.1 and a valid registration. By F use IO::Socket; use LWP::UserAgent; use HTTP::Cookies; use HTML::Entities; print"\n"; print"\n"; print" MyBB new or die" - Cannot create new UserAgent\n"; $cookiejar=HTTP::Cookies-new...

MyBulletinBoard (MyBB) <= 1.2.11 private.php SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================================== MyBulletinBoard MyBB =4.1 and a valid registration. By F use IO::Socket; use LWP::UserAgent; use HTTP::Cookies; use HTML::Entities; print"\n"; print"\n"; print" MyBB new...

mybbprivate-sql.txt

!/usr/bin/perl MyBB =4.1 and a valid registration. By F use IO::Socket; use LWP::UserAgent; use HTTP::Cookies; use HTML::Entities; print"\n"; print"\n"; print" MyBB new or die" - Cannot create new UserAgent\n"; $cookiejar=HTTP::Cookies-new; $browser-cookiejar$cookiejar; try to log in...

MyBulletinBoard (MyBB) 1.2.11 - 'private.php' SQL Injection (1)

!/usr/bin/perl MyBB =4.1 and a valid registration. By F use IO::Socket; use LWP::UserAgent; use HTTP::Cookies; use HTML::Entities; print"\n"; print"\n"; print" MyBB new or die" - Cannot create new UserAgent\n"; $cookiejar=HTTP::Cookies-new; $browser-cookiejar$cookiejar; try to log in...

Sql injection

Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to 1 forumdisplay.php or 2 a results action in search.php...

Sql injection

Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via 1 the mergepost parameter in a domergeposts action, 2 rid parameter in an allreports action, or 3 threads parameter in a domultimovethreads action to ...

Immunity Canvas: PHPMYBB1210_INCLUDE

Name| phpmybb1210include ---|--- CVE| CVE-2008-0382 Exploit Pack| CANVAS Description| PHP MyBB v1.2.10 Command Injection Notes| CVSS: 7.5 Repeatability: Infinite VENDOR: mybboard.net CVE Url: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2008-0382 CVE Name: CVE-2008-0382...

CVE-2008-0382

Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to 1 forumdisplay.php or 2 a results action in search.php...

CVE-2008-0383

Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via 1 the mergepost parameter in a domergeposts action, 2 rid parameter in an allreports action, or 3 threads parameter in a domultimovethreads action to ...

CVE-2008-0383

Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via 1 the mergepost parameter in a domergeposts action, 2 rid parameter in an allreports action, or 3 threads parameter in a domultimovethreads action to ...

CVE-2008-0383

CVE-2008-0383 affects MyBB 1.2.10 and earlier. The vulnerability is a set of SQL injection flaws exploitable via specific parameters: mergepost in do_mergeposts, rid in allreports, threads in do_multimovethreads (moderation.php), and gid in admin/usergroups.php. Root cause is improper handling of...

CVE-2008-0382

CVE-2008-0382 affects MyBB 1.2.10 and earlier. The vulnerability is due to eval injection in the sortby parameter of forumdisplay.php or the results action in search.php, enabling remote attackers to execute arbitrary PHP code. This is a remote, unauthenticated code-execution issue with impact on...

CVE-2008-0382

Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to 1 forumdisplay.php or 2 a results action in search.php...

CVE-2008-0382: Improper Control of Generation of Code

Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to 1 forumdisplay.php or 2 a results action in search.php...

waraxe-2008-SA064.txt

waraxe-2008-SA064 - Sql Injection in MyBB 1.2.11 =============================================================================== Author: Janek Vind "waraxe" Date: 21. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-64.html Target software description: MyBB is a discussion...

CVE-2008-0383: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via 1 the mergepost parameter in a domergeposts action, 2 rid parameter in an allreports action, or 3 threads parameter in a domultimovethreads action to ...

MyBB < 1.2.12 private.php options[disablesmilies] Parameter SQL Injection

Binary data 4353.prm...

MyBB 1.2.11 Multiple XSRF Vulnerabilities

Founded: 18, January 2008 Founder: nbbn MyBB Version: 1.2.11 and lower Type: Multiple XSRF Vulnerabilities 1 Delete Threads XSRF Vulnerabilitie: html head /head body onLoad="javascript:document.formular.submit" form action="http://localhost/xampp/mybb/moderation.php" method="post" name="formular"...

mybb-xsrf.txt

Founded: 18, January 2008 Founder: nbbn MyBB Version: 1.2.11 and lower Type: Multiple XSRF Vulnerabilities 1 Delete Threads XSRF Vulnerabilitie: Poc: 1. Create a .html file and copy the code into it. 2. Upload the file and now send the link to an admin or moderator 3. Done 2 Delete PM's XSRF Vuln...

MyBB多个远程PHP代码执行漏洞

BUGTRAQ ID: 27322 CNCAN ID:CNCAN-2008011706 MyBB是一款基于PHP的WEB应用程序。 MyBB不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意代码. 问题是由于'forumdisplay.php'和'search.php'脚本对用户提交的'fid'参数处理缺少充分过滤，提交恶意数据，在获得"sid"的情况下，可导致任意代码执行。 MyBulletinBoard MyBulletinBoard 1.2.10 MyBulletinBoard MyBulletinBoard 1.2.5 MyBulletinBoard...