Published: 15/02/2008 Updated: 15/10/2018

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

VMScore: 655

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

SQL injection vulnerability in inc/datahandlers/pm.php in MyBB prior to 1.2.12 allows remote authenticated users to execute arbitrary SQL commands via the options[disablesmilies] parameter to private.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mybulletinboard mybulletinboard 1.0.2
mybulletinboard mybulletinboard 1.0.3
mybulletinboard mybulletinboard 1.1.4
mybulletinboard mybulletinboard 1.1.5
mybulletinboard mybulletinboard 1.2.11
mybulletinboard mybulletinboard 1.2.3
mybulletinboard mybulletinboard 1.0
mybulletinboard mybulletinboard 1.0.1
mybulletinboard mybulletinboard 1.1.2
mybulletinboard mybulletinboard 1.1.3
mybulletinboard mybulletinboard 1.2
mybulletinboard mybulletinboard 1.2.10
mybulletinboard mybulletinboard 1.1
mybulletinboard mybulletinboard 1.1.1
mybulletinboard mybulletinboard 1.1.8
mybulletinboard mybulletinboard 1.10
mybulletinboard mybulletinboard rc3
mybulletinboard mybulletinboard rc4
mybulletinboard mybulletinboard 1.0.4
mybulletinboard mybulletinboard 1.0_pr2
mybulletinboard mybulletinboard 1.1.6
mybulletinboard mybulletinboard 1.1.7
mybulletinboard mybulletinboard 1.2.5
mybulletinboard mybulletinboard rc1
mybulletinboard mybulletinboard rc2

#!/usr/bin/perl # # MyBB <=1211 SQL Injection Exploit based on wwwwaraxeus/advisory-64html # # Needs MySQL >=41 and a valid registration # # By F # use IO::Socket; use LWP::UserAgent; use HTTP::Cookies; use HTML::Entities; #### print("\n"); print("############################################################################ ...

CWE-89 http://www.waraxe.us/advisory-64.html http://community.mybboard.net/showthread.php?tid=27675 http://www.securityfocus.com/bid/27378 http://www.securitytracker.com/id?1019257 http://secunia.com/advisories/28572/http://www.vupen.com/english/advisories/2008/0238 https://www.exploit-db.com/exploits/5070 http://www.securityfocus.com/archive/1/486763/100/200/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/5070/

CVE-2008-0787

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect