CVE-2006-3775

SQL injection vulnerability in the init function in classsession.php in MyBB aka MyBulletinBoard 1.1.5 allows remote attackers to execute arbitrary SQL commands via the CLIENT-IP HTTP header $SERVER'HTTPCLIENTIP' variable, as utilized by index.php...

CVE-2006-3760

Multiple SQL injection vulnerabilities in MyBB aka MyBulletinBoard 1.1.4 allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2006-3759

Unspecified vulnerability in MyBB aka MyBulletinBoard 1.1.4, related has unspecified impact and attack vectors related to "user group manipulation."...

CVE-2006-3758

inc/init.php in Archive Mode Light in MyBB aka MyBulletinBoard 1.1.4 calls the extract function with EXTROVERWRITE on HTTP POST and GET variables, which allows remote attackers to overwrite arbitrary variables, as demonstrated via an SQL injection using the SERVERHTTPCLIENTIP parameter in...

CVE-2006-3761

Cross-site scripting XSS vulnerability in inc/functionspost.php in MyBB aka MyBulletinBoard 1.0 RC2 through 1.1.4 allows remote attackers to inject arbitrary web script or HTML via a javascript URI with an SGML numeric character reference in the url BBCode tag, as demonstrated using "javacript"...

CVE-2006-3758

inc/init.php in Archive Mode Light in MyBB aka MyBulletinBoard 1.1.4 calls the extract function with EXTROVERWRITE on HTTP POST and GET variables, which allows remote attackers to overwrite arbitrary variables, as demonstrated via an SQL injection using the SERVERHTTPCLIENTIP parameter in...

CVE-2006-3759

Unspecified vulnerability in MyBB aka MyBulletinBoard 1.1.4, related has unspecified impact and attack vectors related to "user group manipulation."...

CVE-2006-3761

Cross-site scripting XSS vulnerability in inc/functionspost.php in MyBB aka MyBulletinBoard 1.0 RC2 through 1.1.4 allows remote attackers to inject arbitrary web script or HTML via a javascript URI with an SGML numeric character reference in the url BBCode tag, as demonstrated using "javacript"...

CVE-2006-3759

Technical details, affected product versions, root cause, and exploitation specifics are not provided in the supplied documents. Monitor for updates from NVD/CVE listings for CVE-2006-3759.

CVE-2006-3758

CVE-2006-3758 pertains to MyBB (aka MyBulletinBoard) 1.1.4 where inc/init.php in Archive Mode (Light) calls PHP’s extract with EXTR_OVERWRITE on HTTP POST/GET variables, allowing a remote attacker to overwrite arbitrary variables. The vulnerability is demonstrated via an SQL injection using the _...

CVE-2006-3761

CVE-2006-3761 is a cross-site scripting (XSS) vulnerability in MyBB (MyBulletinBoard) affecting versions 1.0 RC2 through 1.1.4, reported as an issue in inc/functions_post.php. The vulnerability allows remote attackers to inject arbitrary web script or HTML by crafting a javascript URI containing ...

CVE-2006-3760

CVE-2006-3760 affects MyBB (MyBulletinBoard) 1.1.4 with multiple SQL injection vulnerabilities allowing remote execution of arbitrary SQL commands via unspecified vectors. Connected documents confirm the issue but do not provide concrete exploit vectors, affected components beyond the product/ver...

MyBB HTTP Header 'CLIENT-IP' Field SQLi

The version of MyBB installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'CLIENT-IP' request header before using it in a database query when initiating a session in the inc/classsession.php script. A remote attacker c...

mybb-sql-115.php.txt

!/usr/bin/php -q -d shortopentag=on ? echo "MyBulletinBoard MyBB = 1.1.5 'CLIENT-IP' SQL injection / create new admin exploit\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork, version specific: "Powered By MyBB" "2006 MyBB Group"\n\n"; / works...

MyBulletinBoard (MyBB) <= 1.1.5 (CLIENT-IP) SQL Injection Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "MyBulletinBoard MyBB = 1.1.5 'CLIENT-IP' SQL injection / create new admin exploit\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork, version specific: "Powered By MyBB"...

MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection

!/usr/bin/php -q -d shortopentag=on ? echo "MyBulletinBoard MyBB = 1.1.5 'CLIENT-IP' SQL injection / create new admin exploit\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork, version specific: "Powered By MyBB" "2006 MyBB Group"\n\n"; / works...

CVE-2006-3420

Cross-site request forgery CSRF vulnerability in editpost.php in MyBulletinBoard MyBB before 1.1.5 allows remote attackers to perform unauthorized actions as a logged in user and delete arbitrary forum posts via a bbcode IMG tag with a modified delete parameter in a deletepost action. NOTE: the...

CVE-2006-3420

CVE-2006-3420 affects MyBulletinBoard (MyBB) prior to version 1.1.5. The issue is a cross-site request forgery (CSRF) in editpost.php that lets an attacker perform actions as a logged-in user, including deleting arbitrary forum posts, by using a bbcode IMG tag with a modified delete parameter in ...

kapda-50.txt

KAPDA::50MyBB 1.1.4 Multiple Vuln SQLInjection & XSS ------- KAPDA New Advisory . http://www.kapda.ir/advisory-349.html ORIGINAL ADVISORY: http://myimei.com/security/2006-06-24/mybb...verwriting.html http://myimei.com/security/2006-06-22/mybb...in-url-tag.html -Summary- Software: MyBB Sowtwares W...

[KAPDA]http://myimei.com/security/2006-06-24/mybb104archive-modelight-parameter-extractionvarable-overwriting.html

ORIGINAL ADVISORY: http://kapda.ir/page-advisory.html http://myimei.com/security/2006-06-24/mybb104archive-modelight-parameter-extractionvarable-overwriting.html ——————-Summary—————- Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.1.4 Class: Remote Status: Patched Exploit:...