Bo-Blog 2.1.1 usergroup参数 跨站脚本攻击漏洞

No description provided by source...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/modules/user/users.php in MyBB aka MyBulletinBoard 1.6.6 allows remote attackers to inject arbitrary web script or HTML via the conditionsusergroup parameter in a search action to admin/index.php...

CVE-2012-5909

The CVE covers a SQL injection in MyBB (MyBulletinBoard) 1.6.6. Affected component: admin/modules/user/users.php; root cause: unsafely constructed SQL via the conditions[usergroup][] parameter in a search action to admin/index.php. Impact is partial confidentiality/integrity/availability as per C...