PT-2013-6194 · Mybb · Mybb Ajaxfs Plugin+1

Publicado 2013-12-04 · Atualizado 2017-08-29 · CVE-2013-6936

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MyBB Ajaxfs Plugin version 2.0

Description The issue concerns SQL injection vulnerabilities in the ajaxfs.php file of the Ajax forum stat Plugin for MyBB. Remote attackers can execute arbitrary SQL commands by manipulating the tooltip or usertooltip parameters.

Recommendations For MyBB Ajaxfs Plugin version 2.0, consider restricting access to the ajaxfs.php file until a patch is available. As a temporary workaround, avoid using the tooltip and usertooltip parameters in the affected API endpoint.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2013-6936

Produtos afetados

Mybb

Mybb Ajaxfs Plugin

Referências · 8

• 🔥 http://exploit-db.com/exploits/29797 · Exploit
• 🔥 https://exploit-db.com/exploits/29797 · Exploit
• 🔥 http://seclists.org/bugtraq/2013/Nov/102 · Exploit
• 🔥 http://packetstormsecurity.com/files/124091/MyBB-Ajaxfs-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6936 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89084 · Nota
• http://osvdb.org/100030 · Nota
• http://iedb.ir/exploits-889.html · Nota