CVE-2010-4627

Cross-site request forgery CSRF vulnerability in usercp2.php in MyBB aka MyBulletinBoard before 1.4.12 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2010-4624

CVE-2010-4624 affects MyBB (MyBulletinBoard) up to version 1.4.12. Remote authenticated users can bypass restrictions on the number of [img] MyCodes by editing a post after creation. Root cause details are not elaborated in the provided documents beyond the basic description. Impact is limited to...

CVE-2010-4522

MyBB versions 1.4.14 and 1.6.x before 1.6.1 contain multiple XSS vulnerabilities that allow remote attackers to inject arbitrary script/HTML via editpost.php, member.php, and newreply.php. Root cause is improper input handling in those endpoints leading to stored/reflected input being executed in...

CVE-2010-4522

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard 1.4.14, and 1.6.x before 1.6.1, allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 editpost.php, 2 member.php, and 3 newreply.php...

CVE-2010-4627

The CVE-2010-4627 issue affects MyBB (MyBulletinBoard) prior to 1.4.12, where a CSRF in usercp2.php could allow remote attackers to hijack user authentication via unknown vectors. Documented impact is authenticated session hijack; no concrete exploit details are provided in the sources. Acknowled...

CVE-2010-4628

CVE-2010-4628 affects MyBB (MyBulletinBoard) prior to 1.4.12. A superfluous SQL COUNT call in member.php allows remote attackers to cause resource consumption by triggering scans of the entire users table, leading to DoS. The referenced sources indicate the vulnerability, with no explicit exploit...

CVE-2010-4625

Affected software: MyBB (MyBulletinBoard) prior to version 1.4.12. Vulnerable component: portal page Latest Threads block that may read hidden threads. Root cause: mis-handling of a configuration where a visible forum contains hidden threads, enabling information disclosure. Impact: remote attack...

MyBB 1.6 <= SQL Injection Vulnerability

================================= MyBB 1.6 = SQL Injection Vulnerability ================================= 1. OVERVIEW Potential SQL Injection vulnerability was detected in MyBB. 2. APPLICATION DESCRIPTION MyBB is a free bulletin board system software package developed by the MyBB Group. It's...

MyBB 1.6 <= SQL Injection Vulnerability

================================= MyBB 1.6 = SQL Injection Vulnerability ================================= 1. OVERVIEW Potential SQL Injection vulnerability was detected in MyBB. 2. APPLICATION DESCRIPTION MyBB is a free bulletin board system software package developed by the MyBB Group. It's...

MyBB 1.6 SQL Injection

================================= MyBB 1.6 /search.php POST /mybb/search.php action=dosearch&forums=2&keywords='+or+'a'+'a&postthread=1 = /private.php POST /mybb/private.php mypostkey=&keywords='+or+'a'+'a&quicksearch=Search+PMs&allbox=Check+All&fromfid=0&fid=4&jumpto=4&action=dostuff 6. SOLUTION...

MyBB 1.6 - search.php?keywords SQL Injection

MyBB 1.6 - search.php?keywords SQL Injection source: https://www.securityfocus.com/bid/45565/info MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker t...

MyBB 1.6 - 'search.php?keywords' SQL Injection

source: https://www.securityfocus.com/bid/45565/info MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modif...

MyBB 1.6 - 'private.php?keywords' SQL Injection

source: https://www.securityfocus.com/bid/45565/info MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modif...

MyBB 1.6 - private.php?keywords SQL Injection

MyBB 1.6 - private.php?keywords SQL Injection source: https://www.securityfocus.com/bid/45565/info MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker ...

MyBB 1.6 <= Cross Site Scripting (XSS) Vulnerability

============================================ MyBB 1.6 = Cross Site Scripting XSS Vulnerability ============================================ 1. OVERVIEW MyBB was vulnerable to Cross Site Scripting Vulnerability. 2. APPLICATION DESCRIPTION MyBB is a free bulletin board system software package...

MyBB 1.6 Cross Site Scripting

============================================ MyBB 1.6 alert/XSS/&quotedids=&lastpid=1&frompage=1&tid=1&method=quickreply&message=test&previewpost=Preview Post 6. SOLUTION Upgrade to 1.6.1 7. VENDOR MyBB Development Team http://www.mybb.com/ 8. CREDIT This vulnerability was discovered by Aung Khan...

MyBB Cross Site Scripting

MyBB all version tags.php?tag= - Cross-Site Scripting XSS & HTML Injection http://www.mybb.com 12-12-2010 Poc: http://infectionsupport.com/tags.php?tag= "alertString.fromCharCode88,83,83 http://infectionsupport.com/tags.php?tag=" Google dork: powered by mybb inurl:tags.php?tag= by Teamelite...

MyBB 1.4.10 - tags.php Cross-Site Scripting

MyBB 1.4.10 - tags.php Cross-Site Scripting source: https://www.securityfocus.com/bid/45388/info MyBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of ...

MyBB 1.4.10 - 'tags.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/45388/info MyBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...

MyBB v1.6 Full Path Disclosure Vulnerability

Exploit for php platform in category web applications ============================================ MyBB v1.6 Full Path Disclosure Vulnerability ============================================ Reference: http://www.htbridge.ch/advisory/pathdisclosureinmybb.html Product: MyBB Vendor: MyBB...