MyBB 1.4 admin remote code execution vulnerability

在index.php文件336行左右代码如下： //index.php,336行左右 $plugins-runhooks"indexend"; //出现了eval函数，注意参数 eval"$index = "".$templates-get"index"."";"; outputpage$index; /code 看以下eval函数中的内容是否可以控制，继续找到templates类查看get函数的定义 code //inc/classtemplates.php,65行左右 function get$title, $eslashes=1, $htmlcomments=1 global...

MyBB adodb_mktime()日期参数远程拒绝服务漏洞

CVE ID：CVE-2009-4448 MyBB是一款流行的基于PHP的论坛程序。 MyBB inc/functionstime.php文件中包含的adodbmktime函数在处理部分日期值时存在漏洞，攻击者提交包含超大的year参数值的报文就会触发大量循环，导致CPU负载过高造成拒绝服务攻击。 MyBB 1.4.10 用户可参考如下安全公告获得补丁信息： http://dev.mybboard.net/projects/mybb/repository/revisions/4613/diff/branches/1.4-stable/inc/functionstime.php...

CVE-2009-4449

Directory traversal vulnerability in MyBB aka MyBulletinBoard 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery...

Directory traversal

Directory traversal vulnerability in MyBB aka MyBulletinBoard 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery...

Design/Logic Flaw

inc/functionstime.php in MyBB aka MyBulletinBoard 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service CPU consumption via a crafted request with a large year value, which triggers a long loop, as reachable through member.php and possibly other vectors...

CVE-2009-4449

Directory traversal vulnerability in MyBB aka MyBulletinBoard 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery...

CVE-2009-4448

inc/functionstime.php in MyBB aka MyBulletinBoard 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service CPU consumption via a crafted request with a large year value, which triggers a long loop, as reachable through member.php and possibly other vectors...

CVE-2009-4449

MyBB 1.4.10 and earlier are affected by a directory traversal vulnerability in the avatar/gallery change flow, allowing remote authenticated users to infer file existence via traversal sequences in avatar and possibly gallery parameters. The issue concerns files admin/modules/user/users.php and u...

CVE-2009-4448

MyBB (MyBulletinBoard) 1.4.10 and possibly earlier versions contain a DoS vulnerability in inc/functions_time.php (adodb_mktime) where processing a crafted request with a large year value triggers a long loop, leading to high CPU usage. This can be reached via member.php and potentially other vec...

MyBB 1.4.10 Cross Site Scripting

=============================================== + MyBB v1.4.10 XSS Vulnerability + Author: Steven Abbagnaro + Site: http://ProminentSecurity.com + Contact: [email protected] =============================================== + Exploit http://server/myps.php?action=donate&username="/...

MyBB Avatar参数文件枚举信息泄露漏洞

BUGTRAQ ID: 37489 MyBB是一款流行的Web论坛程序。 在更改用户的头像时MyBB没有正确地过滤avatar参数便用于检查是否存在文件。由于仅在可确认文件存在的情况下才可以成功执行头像更改，这可能允许攻击者通过目录遍历攻击枚举出已有的文件。 MyBB 1.4.10 厂商补丁： MyBB ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://dev.mybboard.net/issues/617...

PT-2009-6570 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB versions 1.4.10 and earlier Description: The issue allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters when changing the user avatar fr...

MyBB MYPS插件username参数跨站脚本执行漏洞

BUGTRAQ ID: 37464 MyBB是一款流行的Web论坛程序。 如果将action设置为donate的话，MyBB的MYPS插件没有正确地过滤提交给myps.php页面的username参数便返回给了用户，远程攻击者可以通过提交恶意请求执行跨站脚本攻击，导致在用户浏览器会话中执行任意HTML和脚本代码。 MyBB 1.4.10 厂商补丁： MyBB ---- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.mybboard.com/...

MyBB 1.4.10 - 'myps.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/37464/info MyBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...

MyBB 1.4.10 - myps.php Cross-Site Scripting

MyBB 1.4.10 - myps.php Cross-Site Scripting source: https://www.securityfocus.com/bid/37464/info MyBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of ...

MyBB v1.4.10 - myps plugin XSS Vulnerability

No description provided by source. =============================================== + MyBB v1.4.10 - myps plugin XSS Vulnerability + Author: Steven Abbagnaro + Site: http://ProminentSecurity.com + Contact: [email protected] =============================================== + Exploit...

FreeBSD Ports: mybb

The remote host is missing an update to the system as announced in the referenced advisory. VID beb6f4a8-add5-11de-8b55-0030843d3802 OpenVAS Vulnerability Test $ Description: Auto generated from VID beb6f4a8-add5-11de-8b55-0030843d3802 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

FreeBSD Ports: mybb

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD : mybb -- multiple vulnerabilities (beb6f4a8-add5-11de-8b55-0030843d3802)

mybb team reports : Input passed via avatar extensions is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by uploading specially named avatars. The script allows to sign up with usernames containing zero width space characters, which can be...

MyBB用户名欺骗和SQL注入漏洞

BUGTRAQ ID: 36463,36460 MyBB是一款流行的Web论坛程序。 MyBB允许拷贝其他用户的用户名并在其中放置0宽度的空格。由于这两个用户名看起来完全一致，因此可能导致欺骗攻击。 MyBB没有正确地过滤通过avatar扩展所传送的输入便在SQL查询中使用，远程攻击者可以通过上传特殊命名的avatar执行SQL注入攻击。 此外，Custom MyCode实现中的漏洞允许管理员使用eval表达式，但这个漏洞风险较低，因为管理员需要入侵自己的论坛。 MyBB 1.4.8 厂商补丁： MyBB ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...