PT-2005-3470 · Mybb · Mybb

Phuket · Publicado 2005-08-16 · Atualizado 2016-10-18 · CVE-2005-2580

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MyBB version 1.00 RC4 with Security Patch

Description The issue allows remote attackers to execute arbitrary SQL commands, potentially leading to data manipulation or extraction. This can be achieved via several API endpoints, including "index.php", "member.php", "search.php", and "polls.php", by exploiting the Username field, action parameter, or polloptions parameter.

Recommendations For MyBB version 1.00 RC4 with Security Patch, consider disabling the Username field in "index.php" and "member.php", restricting access to the action parameter in "search.php" and "member.php", and limiting the use of the polloptions parameter in "polls.php" until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2005-2580

Produtos afetados

Mybb

Referências · 7

• 🔥 https://exploit-db.com/exploits/26150 · Exploit
• 🔥 https://exploit-db.com/exploits/26148 · Exploit
• 🔥 https://exploit-db.com/exploits/26147 · Exploit
• 🔥 https://exploit-db.com/exploits/26149 · Exploit
• http://marc.info/?l=bugtraq&m=112387501519835&w=2 · Nota
• http://securityfocus.com/bid/14553 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2580 · Nota de Segurança