[Forgot Password]
Login  Register Subscribe

23631

 
 

115084

 
 

97559

 
 

909

 
 

78730

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2005-4199

Date: (C)2005-12-13   (M)2015-12-16
 
CVSS Score: 7.5Access Vector: NETWORK
Exploitability Subscore: 10.0Access Complexity: LOW
Impact Subscore: 6.4Authentication: NONE
 Confidentiality: PARTIAL
 Integrity: PARTIAL
 Availability: PARTIAL











Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options action in usercp.php; (6) list parameter in an editlists action to usercp.php; (7) rating parameter in a rate action in member.php; and (8) rating parameter in either showthread.php or ratethread.php.

Reference:
SECTRACK-1015407
BID-15793
SECUNIA-18000
http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0379.html
http://www.securityfocus.com/archive/1/archive/1/420159/100/0/threaded
OSVDB-22156
OSVDB-22157
OSVDB-22158
SREASON-246
SREASON-294
ADV-2005-2842
http://community.mybboard.net/showthread.php?tid=5184&pid=30964#pid30964
http://www.trapkit.de/advisories/TKADV2005-12-001.txt
http://www.trapkit.de/advisories/TKPN2005-12-001.txt

CPE    7
cpe:/a:mybb:mybb:1.0:rc3
cpe:/a:mybb:mybb:1.0:rc2
cpe:/a:mybb:mybb:1.0:rc4
cpe:/a:mybb:mybb:1.0:rc1
...
CWE    1
CWE-89

© 2013 SecPod Technologies