PT-2008-1754 · Myphp · Myphp Forum

The:Paradox · Published 2008-01-08 · Updated 2017-09-29 · CVE-2008-0099

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MyPHP Forum versions 3.0 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the searchtext parameter to the "search.php" endpoint, and potentially other vectors.

Recommendations For MyPHP Forum versions 3.0 and earlier, avoid using the searchtext parameter in the "search.php" endpoint until the issue is resolved. Restrict access to the search functionality to minimize the risk of exploitation.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-0099

Affected Products

Myphp Forum

References · 4

• 🔥 https://exploit-db.com/exploits/4831 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0099 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0099 · Note
• http://securityfocus.com/bid/27118 · Note