[Forgot Password]
Login  Register Subscribe

23631

 
 

126995

 
 

100182

 
 

909

 
 

80298

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2005-4199

Date: (C)2005-12-13   (M)2015-12-16 


Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options action in usercp.php; (6) list parameter in an editlists action to usercp.php; (7) rating parameter in a rate action in member.php; and (8) rating parameter in either showthread.php or ratethread.php.

CVSS Score: 7.5Access Vector: NETWORK
Exploit Score: 10.0Access Complexity: LOW
Impact Score: 6.4Authentication: NONE
 Confidentiality: PARTIAL
 Integrity: PARTIAL
 Availability: PARTIAL





Reference:
SECTRACK-1015407
BID-15793
SECUNIA-18000
http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0379.html
http://www.securityfocus.com/archive/1/archive/1/420159/100/0/threaded
OSVDB-22156
OSVDB-22157
OSVDB-22158
SREASON-246
SREASON-294
ADV-2005-2842
http://community.mybboard.net/showthread.php?tid=5184&pid=30964#pid30964
http://www.trapkit.de/advisories/TKADV2005-12-001.txt
http://www.trapkit.de/advisories/TKPN2005-12-001.txt

CPE    7
cpe:/a:mybb:mybb:1.0:rc3
cpe:/a:mybb:mybb:1.0:rc2
cpe:/a:mybb:mybb:1.0:rc4
cpe:/a:mybb:mybb:1.0:rc1
...
CWE    1
CWE-89

© 2013 SecPod Technologies