CVE-2012-5909

SQL injection vulnerability in admin/modules/user/users.php in MyBB aka MyBulletinBoard 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditionsusergroup parameter in a search action to admin/index.php...

CVE-2012-5908

Cross-site scripting XSS vulnerability in admin/modules/user/users.php in MyBB aka MyBulletinBoard 1.6.6 allows remote attackers to inject arbitrary web script or HTML via the conditionsusergroup parameter in a search action to admin/index.php...

MyBB FollowerUser插件'usid'参数SQL注入漏洞

BUGTRAQ ID: 56366 MyBB是一款流行的Web论坛程序。通过FollowerUser插件可根据用户配置文件跟踪用户。 FollowerUser插件1.5及其他版本存在SQL注入漏洞，当"uid"设置为当前用户ID、"suscriberuser"设置为"yes"，通过"usid"参数发送到misc.php的输入没有正确在"SuscribeUsersadd" 函数 inc/plugins/SuscribeUsers.php 内过滤，及被用在SQL查询中。通过注入任意SQL代码，可被利用操作SQL查询。 0 MyBB Follower User 1.x 厂商补丁： MyBB...

MyBB Follower User Plugin - SQL Injection

MyBB Follower User Plugin - SQL Injection Exploit Title: Follower User MyBB plugin SQL Injection 0day Google Dork: intext:"Users subscribed to" inurl:member.php -site:fwcombie.us Date: 13.10.2012 Exploit Author: Zixem Software Link: http://mods.mybb.com/view/suscriber-user Version: 1.5+ Tested on...

MyBB Follower User Plugin - SQL Injection

Exploit Title: Follower User MyBB plugin SQL Injection 0day Google Dork: intext:"Users subscribed to" inurl:member.php -site:fwcombie.us Date: 13.10.2012 Exploit Author: Zixem Software Link: http://mods.mybb.com/view/suscriber-user Version: 1.5+ Tested on: Linux...

MyBB Follower User 1.5 SQL Injection

Exploit Title: Follower User MyBB plugin SQL Injection 0day Google Dork: intext:"Users subscribed to" inurl:member.php -site:fwcombie.us Date: 13.10.2012 Exploit Author: Th3FreakPony Software Link: http://mods.mybb.com/view/suscriber-user Version: 1.5+ Tested on: Linux...

MyBB Follower User Plugin SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Follower User MyBB plugin SQL Injection 0day Google Dork: intext:"Users subscribed to" inurl:member.php -site:fwcombie.us Date: 13.10.2012 Exploit Author: Th3FreakPony Software Link: http://mods.mybb.com/view/suscriber-user...

MyBB Profile Albums Plugin 0.9 - albums.php?album SQL Injection

MyBB Profile Albums Plugin 0.9 - albums.php?album SQL Injection Exploit Title: Profile Albums MyBB plugin SQL Injection 0day Google Dork: inurl:albums.php intext:"powered by Mybb" Date: 14.10.2012 Exploit Author: Zixem Software Link: http://mods.mybb.com/view/profilealbums Version: 0.9 Tested on:...

MyBB Profile Albums 0.9 SQL Injection

Exploit Title: Profile Albums MyBB plugin SQL Injection 0day Google Dork: inurl:albums.php intext:"powered by Mybb" Date: 14.10.2012 Exploit Author: Th3FreakPony Software Link: http://mods.mybb.com/view/profilealbums Version: 0.9 Tested on: Linux. ---------------------------------------------- Th...

MyBB Profile Albums Plugin 0.9 - 'albums.php?album' SQL Injection

Exploit Title: Profile Albums MyBB plugin SQL Injection 0day Google Dork: inurl:albums.php intext:"powered by Mybb" Date: 14.10.2012 Exploit Author: Zixem Software Link: http://mods.mybb.com/view/profilealbums Version: 0.9 Tested on: Linux. ---------------------------------------------- The...

MyBB 1.6.8 Cross Site Scripting

Exploit Title : Mybb 1.6.8 Cross Site Scripting Author : 3xpl0!t3r Discovered By : Sec-Advisor.Org Date : 12 Oct 2012 Home : http://Sec-Advisor.Org Source : http://www.mybb.com/download/latest file : /inc/classerror.php 510: echo echo $mybb-settings'bbname' - Internal Error body background: efefe...

MyBB Remote Command Execution

No description provided by source. Exploit Title : Mybb All Versions Remote Command Execution Author : Nafsh Discovered By : Tapco Security & Research Lab Date : 3 Oct 2012 Home : http://Sec-Lab.Tap-Co.Net Contact : [email protected] Source : http://www.mybb.com/download/latest file :...

MyBB Remote Command Execution

ÿþ Exploit Title : Mybb All Versions Remote Command Execution Author : Nafsh Discovered By : Tapco Security & Research Lab Date : 3 Oct 2012 Home : http://Sec-Lab.Tap-Co.Net Contact : [email protected] Source : http://www.mybb.com/download/latest file : /inc/3rdparty/diff/Diff/Engine/shell.php...

CVE-2011-5131

Cross-site request forgery CSRF vulnerability in global.php in MyBB before 1.6.5 allows remote attackers to hijack the authentication of a user for requests that change the user's language via the language parameter...

CVE-2011-5133

Unspecified vulnerability in MyBB before 1.6.5 has unknown impact and attack vectors, related to an "unparsed user avatar in the buddy list."...

CVE-2011-5132

Cross-site scripting XSS vulnerability in MyBB before 1.6.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "usernames via AJAX."...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in global.php in MyBB before 1.6.5 allows remote attackers to hijack the authentication of a user for requests that change the user's language via the language parameter...

Design/Logic Flaw

Unspecified vulnerability in MyBB before 1.6.5 has unknown impact and attack vectors, related to an "unparsed user avatar in the buddy list."...

Cross site scripting

Cross-site scripting XSS vulnerability in MyBB before 1.6.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "usernames via AJAX."...

CVE-2011-5132

Cross-site scripting XSS vulnerability in MyBB before 1.6.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "usernames via AJAX."...