PT-2005-2800 · Mybb · Mybb

Alberto Trivero · Published 2005-05-31 · Updated 2016-10-18 · CVE-2005-1833

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MyBB version 1.00 RC4

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via various parameters in different PHP files, including the eid parameter to "calendar.php", the idsql parameter to "online.php", the usersearch parameter to "memberlist.php", the pid parameter to "editpost.php", the fid parameter to "forumdisplay.php", the tid parameter to "newreply.php", the sid parameter to "search.php", the tid or pid parameter to "showthread.php", the tid parameter to "usercp2.php", the tid parameter to "printthread.php", or the pid parameter to "reputation.php".

Recommendations For MyBB version 1.00 RC4, consider disabling the parameters eid, idsql, usersearch, pid, fid, tid, and sid in their respective PHP files until a patch is available. Restrict access to the vulnerable PHP files, such as "calendar.php", "online.php", "memberlist.php", "editpost.php", "forumdisplay.php", "newreply.php", "search.php", "showthread.php", "usercp2.php", "printthread.php", and "reputation.php", to minimize the risk of exploitation. Avoid using these parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-1833

Affected Products

Mybb

References · 6

• 🔥 http://mybboard.com/community/showthread.php?tid=2559 · Exploit
• 🔥 https://exploit-db.com/exploits/1022 · Exploit
• 🔥 http://secunia.com/advisories/15552 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1833 · Security Note
• http://marc.info/?l=bugtraq&m=111757191118050&w=2 · Note
• http://osvdb.org/17024 · Note