CVE-2005-3776: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in MyBulletinBoard MyBB 1.0 PR2 Rev 686 allow remote attackers to inject arbitrary web script or HTML via 1 the subject field when creating a new thread and 2 information passed to the Reputation system...

CVE-2005-3326

The CVE-2005-3326 entry concerns MyBulletinBoard (MyBB) where SQL injection is possible in usercp.php via the awayday parameter, enabling remote SQL commands. Affected software: MyBB/MyBulletinBoard; vulnerable component: usercp.php (likely parameter handling). Underlying cause: unvalidated input...

CVE-2005-3326: Undefined Security Weakness

SQL injection vulnerability in usercp.php in MyBulletinBoard MyBB allows remote attackers to execute arbitrary SQL commands via the awayday parameter...

mybbpr2.pl.txt

Vendor: www.mybboard.com Version: 1.00 Preview Release 2, RC4 and mayb prior. Script: usercp.php Code: if$mybb-input'away' == "yes" && $mybb-settings'allowaway' != "no" ... $returndate = $mybb-input'awayday'."-".$mybb-input'awaymonth'."-".$mybb-input'awayyear'; ... $newprofile = array "website" =...

MyBB misc.php Multiple SQL Injection Vulnerabilities

The version of MyBB installed on the remote host is affected by multiple SQL injection vulnerabilities due to improper sanitization of user-supplied input to the 'fid' parameter of the 'misc.php' script and the 'Content-Disposition' field in the HTTP header to the newreply.php script. A remote...

MyBB ratethread.php 'rating' Parameter SQLi

The version of MyBB installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'rating' parameter of the ratethread.php script. A remote attacker can exploit this issue to manipulate SQL queries, resulting in the disclosure...

CVE-2005-2888

CVE-2005-2888 affects MyBulletinBoard (MyBB) Preview Release 2. The vulnerability lies in two injection vectors: (1) the fid parameter of misc.php and (2) the Content-Disposition header in the HTTP request to newreply.php, due to improper sanitization of user-supplied input. An attacker remotely ...

[Full-disclosure] XSS VULN IN ALL MYBB VERSIONS (INCLUDING PR2)

XSS VULN IN ALL MYBB VERSIONS INCLUDING PR2 Vendor: given SEVEN days notice, no patch released! Just to say, I am apalled with the fact that I contacted MyBB on the 30 August, and was originally not planning to go public. However, because they have failed to release a patch I have decided to aler...

CVE-2005-2778

SQL injection vulnerability in member.php in MyBulletinBoard MyBB allows remote attackers to execute arbitrary SQL statements via the fid parameter...

CVE-2005-2778

The CVE-2005-2778 entry details a SQL injection in MyBulletinBoard (MyBB), specifically in member.php through the fid parameter. A remote attacker can craft input via fid to execute arbitrary SQL statements, with network access and no authentication required (low attack complexity). Affected soft...

mybbSQL.pl.txt

!/usr/bin/perl -w use LWP::Simple; Vitem if!$ARGV0 print " MyBB Member.php SQL Injection \n"; print " Coded By \n"; print " \n"; print " + Bug By W7ED - W7EDathotmail.com \n"; print " \n"; print " Exmp:- perl file.pl mybb.net /mybb userid \n"; print " \n"; exit; my $host = 'http://'.$ARGV0; User ...

MyBB <= 1.00 RC4 Multiple SQL Injection Vulnerabilities

The version of MyBB installed on the remote host is affected by multiple SQL injection vulnerabilities : - Multiple SQL injection vulnerabilities exist due to improper sanitization of user-supplied input passed via the 'Username' field, the 'action' parameter, and the 'polloptions' parameter. A...

MyBB - 'member.php' SQL Injection

source: https://www.securityfocus.com/bid/14684/info MyBB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. Successful exploitation could result in a compromise of the application, disclosure or modification of...

CVE-2005-2697

SQL injection vulnerability in search.php for MyBulletinBoard MyBB 1.00 Release Candidate 1 through 4 allows remote attackers to execute arbitrary SQL commands via the uid parameter. NOTE: this issue might overlap CVE-2005-0282...

CVE-2005-2697

CVE-2005-2697 affects MyBB (MyBulletinBoard) 1.00 Release Candidate 1–4. The vulnerability is an SQL injection in search.php via the uid parameter, allowing a remote attacker to manipulate SQL queries and potentially disclose or modify data. This CVE overlaps with CVE-2005-0282. Connected sources...

MyBulletinBoard (MyBB) 1.00 RC4 - 'search.php' SQL Injection

mybb is dead /str0ke !/usr/bin/perl Crouz.Com Security Team EXPLOIT FOR: MyBulletinBoard Search.PHP SQL Injection Vulnerability Expl0it By: A l p h a P r o g r a m m e r sirius Email: [email protected] This Xpl Change Admin's Pass For L0gin With P0wer User HACKERS PAL & Devil-00 &...

Vul in MyBB

Hello The Injected File : search.php Discovered by: HACKERS PAL & Devil-00 & ABDUCTER Injected Versions :- Powered by MyBulletinBoard 1.00 Release Candidate 4 Powered by MyBulletinBoard 1.00 Release Candidate 3 Powered by MyBulletinBoard 1.00 Release Candidate 2 Powered by MyBulletinBoard 1.00...

CVE-2005-2580

CVE-2005-2580 affects MyBulletinBoard (MyBB) 1.00 RC4 with Security Patch. The vulnerability stems from improper sanitization of user input, enabling SQL injection via the Username field in index.php or member.php, via the action parameter in search.php or member.php, or via the polloptions param...

CVE-2005-2580: Undefined Security Weakness

Multiple SQL injection vulnerabilities in MyBulletinBoard MyBB 1.00 RC4 with Security Patch allow remote attackers to execute arbitrary SQL commands via the Username field in 1 index.php or 2 member.php, action parameter to 3 search.php or 4 member.php, or 5 polloptions parameter to polls.php...

mybb.pl.txt

!/usr/bin/perl -w SQL Injection Exploit for MyBulletinBoard MyBB .?/ && print "+ User ID is: $1\n"; print "- Unable to retrieve User ID\n" if!$1; $page = m/.?/ && print "+ MD5 hash of password is: $1\n"; print "- Unable to retrieve hash of password\n" if!$1;...