PT-2005-5270 · Mybb · Mybb

Addmimistrator · Published 2005-12-31 · Updated 2018-10-19 · CVE-2005-4602

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.0.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the file extension of an uploaded file attachment in the inc/function upload.php file.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting file uploads or validating the file extensions to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-4602

Affected Products

Mybb

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2005-4602 · Security Note
• http://vupen.com/english/advisories/2006/0012 · Note
• http://osvdb.org/22159 · Note
• http://securityreason.com/securityalert/311 · Note
• http://securityfocus.com/bid/16097 · Note
• http://secunia.com/advisories/18281 · Note
• http://securityfocus.com/archive/1/420573/100/0/threaded · Note