vendor:
MyBB
by:
D3vil-0x1 | Devil-00
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: MyBB
Affected Version From: MyBB <= 1.04
Affected Version To: MyBB <= 1.04
Patch Exists: YES
Related CWE: N/A
CPE: a:mybb:mybb
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006
MyBB <= 1.04 (misc.php COMMA) Remote SQL Injection Exploit 2 , Perl C0d3
This exploit allows an attacker to inject malicious SQL code into the misc.php file of MyBB <= 1.04, which can be used to gain access to the loginkey of a user with a given user ID.
Mitigation:
Ensure that user input is properly sanitized and validated before being used in SQL queries.
