PT-2014-2193 · Mybb · Advanced Forum Signatures

Published 2014-04-08 · Updated 2017-08-29 · CVE-2011-5277

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Advanced Forum Signatures plugin version 2.0.4 for MyBB

Description The issue concerns SQL injection vulnerabilities in the signature.php file of the Advanced Forum Signatures plugin for MyBB. Remote attackers can execute arbitrary SQL commands by manipulating certain parameters. The vulnerable parameters include afs type, afs background, afs showonline, afs bar left, afs bar center, afs full line1, afs full line2, afs full line3, afs full line4, afs full line5, and afs full line6.

Recommendations For Advanced Forum Signatures plugin version 2.0.4, consider restricting access to the signature.php file until a patch is available. As a temporary workaround, avoid using the vulnerable parameters in the plugin's configuration to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2011-5277

Affected Products

Advanced Forum Signatures

References · 7

• 🔥 https://exploit-db.com/exploits/17961 · Exploit
• 🔥 http://exploit-db.com/exploits/17961 · Exploit
• 🔥 http://securityfocus.com/bid/50051/info · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5277 · Security Note
• http://secunia.com/advisories/46352 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/70473 · Note
• http://osvdb.org/76295 · Note