CVE-2008-0383

Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via 1 the mergepost parameter in a domergeposts action, 2 rid parameter in an allreports action, or 3 threads parameter in a domultimovethreads action to ...

Sql injection

Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to 1 forumdisplay.php or 2 a results action in search.php...

Immunity Canvas: PHPMYBB1210_INCLUDE

Name| phpmybb1210include ---|--- CVE| CVE-2008-0382 Exploit Pack| CANVAS Description| PHP MyBB v1.2.10 Command Injection Notes| CVSS: 7.5 Repeatability: Infinite VENDOR: mybboard.net CVE Url: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2008-0382 CVE Name: CVE-2008-0382...

Sql injection

Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via 1 the mergepost parameter in a domergeposts action, 2 rid parameter in an allreports action, or 3 threads parameter in a domultimovethreads action to ...

CVE-2008-0382

Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to 1 forumdisplay.php or 2 a results action in search.php...

CVE-2008-0383

CVE-2008-0383 affects MyBB 1.2.10 and earlier. The vulnerability is a set of SQL injection flaws exploitable via specific parameters: mergepost in do_mergeposts, rid in allreports, threads in do_multimovethreads (moderation.php), and gid in admin/usergroups.php. Root cause is improper handling of...

CVE-2008-0383

Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via 1 the mergepost parameter in a domergeposts action, 2 rid parameter in an allreports action, or 3 threads parameter in a domultimovethreads action to ...

CVE-2008-0382

Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to 1 forumdisplay.php or 2 a results action in search.php...

CVE-2008-0382

CVE-2008-0382 affects MyBB 1.2.10 and earlier. The vulnerability is due to eval injection in the sortby parameter of forumdisplay.php or the results action in search.php, enabling remote attackers to execute arbitrary PHP code. This is a remote, unauthenticated code-execution issue with impact on...

waraxe-2008-SA064.txt

waraxe-2008-SA064 - Sql Injection in MyBB 1.2.11 =============================================================================== Author: Janek Vind "waraxe" Date: 21. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-64.html Target software description: MyBB is a discussion...

MyBB < 1.2.12 private.php options[disablesmilies] Parameter SQL Injection

Binary data 4353.prm...

MyBB 1.2.11 Multiple XSRF Vulnerabilities

Founded: 18, January 2008 Founder: nbbn MyBB Version: 1.2.11 and lower Type: Multiple XSRF Vulnerabilities 1 Delete Threads XSRF Vulnerabilitie: html head /head body onLoad="javascript:document.formular.submit" form action="http://localhost/xampp/mybb/moderation.php" method="post" name="formular"...

mybb-xsrf.txt

Founded: 18, January 2008 Founder: nbbn MyBB Version: 1.2.11 and lower Type: Multiple XSRF Vulnerabilities 1 Delete Threads XSRF Vulnerabilitie: Poc: 1. Create a .html file and copy the code into it. 2. Upload the file and now send the link to an admin or moderator 3. Done 2 Delete PM's XSRF Vuln...

MyBB 'moderation.php' SQL注入漏洞

MyBB是一款基于PHP的WEB应用程序。 MyBB不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'moderation.php'脚本对用户提交的'fid'参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 MyBulletinBoard MyBulletinBoard 1.2.10 MyBulletinBoard MyBulletinBoard 1.2.5 MyBulletinBoard MyBulletinBoard 1.2.3 MyBulletinBoard...

MyBB多个远程PHP代码执行漏洞

BUGTRAQ ID: 27322 CNCAN ID:CNCAN-2008011706 MyBB是一款基于PHP的WEB应用程序。 MyBB不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意代码. 问题是由于'forumdisplay.php'和'search.php'脚本对用户提交的'fid'参数处理缺少充分过滤，提交恶意数据，在获得"sid"的情况下，可导致任意代码执行。 MyBulletinBoard MyBulletinBoard 1.2.10 MyBulletinBoard MyBulletinBoard 1.2.5 MyBulletinBoard...

[waraxe-2008-SA#061] - Remote Code Execution in MyBB 1.2.10

waraxe-2008-SA061 - Remote Code Execution in MyBB 1.2.10 =============================================================================== Author: Janek Vind "waraxe" Independent discovery: koziolek Date: 16. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-61.html Target...

mybb1210-exec.txt

!/usr/bin/php -q -d shortopentag=on ?php // magicquotesgpc needs to be off errorreporting0; iniset"maxexecutiontime",0; iniset"defaultsockettimeout",5; if $argc5 print "-------------------------------------------------------------------------\r\n"; print " MyBB = 1.2.10 Remote Code Execution...

waraxe-2008-SA-061.txt

waraxe-2008-SA061 - Remote Code Execution in MyBB 1.2.10 =============================================================================== Author: Janek Vind "waraxe" Independent discovery: koziolek Date: 16. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-61.html Target...

[waraxe-2008-SA#062] - Multiple Sql Injections in MyBB 1.2.10

waraxe-2008-SA062 - Multiple Sql Injections in MyBB 1.2.10 =============================================================================== Author: Janek Vind "waraxe" Date: 16. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-62.html Target software description: MyBB is a...

waraxe-2008-SA-062.txt

waraxe-2008-SA062 - Multiple Sql Injections in MyBB 1.2.10 =============================================================================== Author: Janek Vind "waraxe" Date: 16. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-62.html Target software description: MyBB is a...