PT-2005-3470 · Mybb · Mybb

Phuket · Published 2005-08-16 · Updated 2016-10-18 · CVE-2005-2580

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MyBB version 1.00 RC4 with Security Patch

Description The issue allows remote attackers to execute arbitrary SQL commands, potentially leading to data manipulation or extraction. This can be achieved via several API endpoints, including "index.php", "member.php", "search.php", and "polls.php", by exploiting the Username field, action parameter, or polloptions parameter.

Recommendations For MyBB version 1.00 RC4 with Security Patch, consider disabling the Username field in "index.php" and "member.php", restricting access to the action parameter in "search.php" and "member.php", and limiting the use of the polloptions parameter in "polls.php" until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2005-2580

Affected Products

Mybb

References · 7

• 🔥 https://exploit-db.com/exploits/26150 · Exploit
• 🔥 https://exploit-db.com/exploits/26148 · Exploit
• 🔥 https://exploit-db.com/exploits/26147 · Exploit
• 🔥 https://exploit-db.com/exploits/26149 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2580 · Security Note
• http://marc.info/?l=bugtraq&m=112387501519835&w=2 · Note
• http://securityfocus.com/bid/14553 · Note