PT-2005-3750 · Mybb · Mybb

Devil-00 · Published 2005-09-14 · Updated 2017-07-11 · CVE-2005-2888

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MyBB versions Preview Release 2

Description The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved via the fid parameter to "misc.php" or the Content-Disposition field in the HTTP header to "newreply.php".

Recommendations For MyBB version Preview Release 2, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the "misc.php" and "newreply.php" scripts to minimize the risk of exploitation. Avoid using the fid parameter in the "misc.php" script and the Content-Disposition field in the HTTP header to the "newreply.php" script until the issue is resolved.

Fix

Related Identifiers

CVE-2005-2888

Affected Products

Mybb

References · 4

• http://secunia.com/advisories/16738 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2888 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22192 · Note
• http://marc.info/?l=bugtraq&m=112611068702781&w=2 · Note