Imei

**Name of the Vulnerable Software and Affected Versions** MyBB version 1.1.7 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the query string (`$ SERVER[PHP SELF]`) in the admin/global.php file, also known as the Admin CP login form. **Recommendations** For MyBB version 1.1.7, as a temporary workaround, consider restricting access to the admin/global.php file until a patch is available. Avoid using the query string (`$ SERVER[PHP SELF]`) in the affected login form until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MyBB (aka MyBulletinBoard) version 1.1.4 **Description** The issue allows remote attackers to overwrite arbitrary variables due to the extract function being called with EXTR OVERWRITE on HTTP POST and GET variables in the inc/init.php file when Archive Mode (Light) is used. This can be exploited for SQL injection, for example, by manipulating the ` SERVER[HTTP CLIENT IP]` parameter in archive/index.php. **Recommendations** For MyBB (aka MyBulletinBoard) version 1.1.4, consider restricting access to the archive mode or temporarily disabling the use of the extract function with EXTR OVERWRITE on HTTP variables until a proper fix is available. Avoid using the ` SERVER[HTTP CLIENT IP]` parameter in the archive/index.php file to minimize the risk of SQL injection exploitation.

**Name of the Vulnerable Software and Affected Versions** MyBB version 1.1.4 **Description** The issue is related to user group manipulation and has an unspecified impact and attack vectors. **Recommendations** For MyBB version 1.1.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MyBB version 1.1.4 **Description** The issue allows remote attackers to execute arbitrary SQL commands, potentially leading to data manipulation or extraction. This is due to multiple SQL injection vulnerabilities. **Recommendations** For MyBB version 1.1.4, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** MyBB version 1.02 **Description** A cross-site scripting (XSS) issue exists due to improper handling of the `sortby` and `sortordr` parameters in the search.php file, allowing remote attackers to inject arbitrary web script or HTML. **Recommendations** For MyBB version 1.02, as a temporary workaround, consider restricting access to the search.php file until a patch is available, and avoid using the `sortby` and `sortordr` parameters in the affected API endpoint.

**Name of the Vulnerable Software and Affected Versions** Insane Visions BlogPHP version 1.0 **Description** The issue concerns SQL injection vulnerabilities in the config.php file. Remote attackers can execute arbitrary SQL commands by manipulating the `blogphp username` or `blogphp password` parameter in a cookie. **Recommendations** For Insane Visions BlogPHP version 1.0, consider restricting access to the config.php file and validating user input to prevent SQL injection attacks. As a temporary workaround, avoid using the `blogphp username` and `blogphp password` parameters in cookies until a patch is available.

**Name of the Vulnerable Software and Affected Versions** MyBulletinBoard (MyBB) versions prior to 1.0 **Description** The issue concerns multiple unspecified vulnerabilities with unknown impact and attack vectors. These vulnerabilities are distinct from those identified by other references. **Recommendations** For MyBB versions prior to 1.0, update to version 1.0 or later to resolve the issue.