PT-2013-6194 · Mybb · Mybb Ajaxfs Plugin+1

Published 2013-12-04 · Updated 2017-08-29 · CVE-2013-6936

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MyBB Ajaxfs Plugin version 2.0

Description The issue concerns SQL injection vulnerabilities in the ajaxfs.php file of the Ajax forum stat Plugin for MyBB. Remote attackers can execute arbitrary SQL commands by manipulating the tooltip or usertooltip parameters.

Recommendations For MyBB Ajaxfs Plugin version 2.0, consider restricting access to the ajaxfs.php file until a patch is available. As a temporary workaround, avoid using the tooltip and usertooltip parameters in the affected API endpoint.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2013-6936

Affected Products

Mybb

Mybb Ajaxfs Plugin

References · 8

• 🔥 http://exploit-db.com/exploits/29797 · Exploit
• 🔥 https://exploit-db.com/exploits/29797 · Exploit
• 🔥 http://seclists.org/bugtraq/2013/Nov/102 · Exploit
• 🔥 http://packetstormsecurity.com/files/124091/MyBB-Ajaxfs-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6936 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89084 · Note
• http://osvdb.org/100030 · Note
• http://iedb.ir/exploits-889.html · Note