PT-2005-2799 · Mybb Team · Mybb

Alberto Trivero · Publicado 2005-05-31 · Atualizado 2016-10-18 · CVE-2005-1832

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MyBB versions 1.00 RC4 and earlier

Description The issue allows remote attackers to execute arbitrary web script or HTML. This can be achieved via various parameters, including forums, version, limit to "misc.php", page, datecut to "forumdisplay.php", username, email, email2 to "member.php", page, usersearch to "memberlist.php", pid, tid to "showthread.php", or tid to "printthread.php".

Recommendations For MyBB versions 1.00 RC4 and earlier, consider disabling the affected parameters to mitigate the risk of exploitation until a patch is available. Restrict access to the vulnerable API endpoints, such as "misc.php", "forumdisplay.php", "member.php", "memberlist.php", "showthread.php", and "printthread.php", to minimize the risk of exploitation. Avoid using the vulnerable parameters, including forums, version, limit, page, datecut, username, email, email2, pid, tid, and usersearch, in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-1832

Produtos afetados

Mybb

Referências · 4

• 🔥 http://mybboard.com/community/showthread.php?tid=2559 · Exploit
• 🔥 http://secunia.com/advisories/15552 · Exploit
• http://marc.info/?l=bugtraq&m=111757191118050&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1832 · Nota de Segurança