CVE-2006-0959

CVE-2006-0959 maps to a SQL injection in MyBulletinBoard (MyBB) via the comma cookie parameter in misc.php. The vulnerability is exploitable when PHP register_globals is enabled, allowing remote attackers to modify or disclose data by injecting arbitrary SQL. Affected versions include MyBB 1.03, ...

myBB-SQL.txt

MyBB New SQL Injection D3vil-0x1 Milw0rm ID :- http://www.milw0rm.com/auth.php?id=1320 The Inf.File :- misc.php Linez :- code $buddies = $mybb-user'buddylist'; $namesarray = explode",",$buddies; ifisarray$namesarray whilelist$key, $buddyid = each$namesarray $sql .= "$comma'$buddyid'";...

[SA19061] MyBB "comma" Parameter SQL Injection Vulnerability

TITLE: MyBB "comma" Parameter SQL Injection Vulnerability SECUNIA ADVISORY ID: SA19061 VERIFY ADVISORY: http://secunia.com/advisories/19061/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: MyBB formerly MyBulletinBoard 1.x http://secunia.com/product/4479/...

MyBB 1.3 NewSQL Injection

MyBB New SQL Injection D3vil-0x1 Devil-00 Milw0rm ID :- http://www.milw0rm.com/auth.php?id=1320 The Inf.File :- misc.php Linez :- code $buddies = $mybb-user'buddylist'; $namesarray = explode",",$buddies; ifisarray$namesarray whilelist$key, $buddyid = each$namesarray $sql .= "$comma'$buddyid'"; ==...

MyBulletinBoard (MyBB) 1.03 - misc.php SQL Injection

MyBulletinBoard MyBB 1.03 - misc.php SQL Injection MyBB New SQL Injection D3vil-0x1 Milw0rm ID :- http://www.milw0rm.com/auth.php?id=1320 The Inf.File :- misc.php Linez :- code $buddies = $mybb-user'buddylist'; $namesarray = explode",",$buddies; ifisarray$namesarray whilelist$key, $buddyid =...

MyBulletinBoard (MyBB) 1.03 - 'misc.php' SQL Injection

MyBB New SQL Injection D3vil-0x1 Milw0rm ID :- http://www.milw0rm.com/auth.php?id=1320 The Inf.File :- misc.php Linez :- code $buddies = $mybb-user'buddylist'; $namesarray = explode",",$buddies; ifisarray$namesarray whilelist$key, $buddyid = each$namesarray $sql .= "$comma'$buddyid'";...

CVE-2006-0770

Cross-site scripting XSS vulnerability in calendar.php in MyBulletinBoard MyBB 1.0.4 allows remote attackers to inject arbitrary web script or HTML via a URL that is not sanitized before being returned as a link in "advanced details". NOTE: the provenance of this information is unknown; the detai...

CVE-2006-0770

CVE-2006-0770 concerns a delivered XSS vulnerability in the MyBB (MyBulletinBoard) package, specifically in calendar.php of version 1.0.4. The issue arises when a URL is not properly sanitized and is returned as a link in the advanced details, allowing remote attackers to inject arbitrary web scr...

MyBB1.0.3-managegroup.txt

originnal advisoryimei addmimistrator Risk Level: high -----------------Description--------------- There is a security bug in MyBB 1.0.3 software latest version fully patched file moderation.php that allows attacker performe an SQLINJECTION attack. bug is in result of poor checking quotes for...

MyBB 1.0.21.0.3 - Managegroup.php SQL Injection

MyBB 1.0.21.0.3 - Managegroup.php SQL Injection source: https://www.securityfocus.com/bid/16689/info MyBB is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation...

MyBB 1.0.2/1.0.3 - 'Managegroup.php' SQL Injection

source: https://www.securityfocus.com/bid/16689/info MyBB is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could allow an attacker to compromise the...

MyBB1.0.3-private.txt

\ORIGINAL ADVISORYimei addmimistrator Risk Level: high —————–Description————— There is some security bug in MyBB 1.0.3 software latest version fully patched file private.php that allows attacker performe an SQLINJECTION attack. bug is in result of poor checking quotations for user suplied...

[myimei]MyBB 1.0.3~private.php~multiple SqlInjection

ORIGINAL ADVISORY/ http://myimei.com/security/2006-02-11/mybb-103privatephpmultiple-sqlinjection.html Vendor Credit:http://community.mybboard.net/showthread.php?tid=6777 ——————-Summary—————- Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.0.3 Class: Remote Status: Unpatche...

MyBB 1.0.3 - Managegroup.php Cross-Site Scripting

MyBB 1.0.3 - Managegroup.php Cross-Site Scripting source: https://www.securityfocus.com/bid/16692/info MyBB is prone to a cross-site scripting vulnerability.. This issue is due to a lack of proper sanitization of user-supplied input. An attacker may leverage this issue to have arbitrary script co...

[myimei]MyBB1.0.3~managegroup.php~Multiple SqlInjection & XSS

ORIGINAL ADVISORY/ http://myimei.com/security/2006-02-10/mybb103managegroupphpmultiple-sqlinjection-xss.html Vendor Credit:http://community.mybboard.net/showthread.php?tid=6777 ——————-Summary—————- Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.0.3 Class: Remote Status:...

MyBB1.0.3~managegroup.php~Multiple SqlInjection & XSS

originnal advisory http://myimei.com/security/2006-02-10/mybb103managegroupphpmultiple-sqlinjection-xss.html -------------------Summary---------------- Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.0.3 Class: Remote Status: Unpatched Exploit: Available Discovered by:...

MyBB < 1.04 misc.php SQLi

The version of MyBB installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the comma variable via the 'comma' parameter in a cookie. If PHP's 'registerglobals' setting is enabled, a remote, unauthenticated attacker can...

MyBB 1.0.3 - 'Managegroup.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/16692/info MyBB is prone to a cross-site scripting vulnerability.. This issue is due to a lack of proper sanitization of user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user...

MyBulletinBoard (MyBB) 1.03 - Multiple SQL Injections

MyBulletinBoard MyBB 1.03 - Multiple SQL Injections !/bin/env perl //------------------------------------------------------------- // MyBB Forum SQL Injection Exploit .. By HACKERS PAL // Greets For Devil-00 - Abducter - Almaster - GaCkeR // Special Greets For SG SecurityGurus Team And Members //...

MyBB 1.03 Multible xss and sql injections

Multible Injections in MyBB 1.03 All injections and vulnerabilities discovered by : HACKERS PAL two days ago i thought to download the new Mybb forum new version files .. and there were the desaster there is many xss and sql injections in the new protected version ... and i made a exploit which g...