CVE-2010-5096
published 2012-08-13CVE-2010-5096: Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords…
PriorityP348high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
5.58%
91.9th percentile
Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in a (1) do_search action to search.php or (2) do_stuff action to private.php. NOTE: the vendor disputes this issue, saying "Although this doesn't lead to an SQL injection, it does provide a general MyBB SQL error.
Affected
52 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mybb | mybb | <= 1.6.0 | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
| mybb | mybb | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
MyBB 1.6 - 'search.php?keywords' SQL Injection
exploitdb·2010-12-23
CVE-2010-5096 MyBB 1.6 - 'search.php?keywords' SQL Injection
MyBB 1.6 - 'search.php?keywords' SQL Injection
---
source: https://www.securityfocus.com/bid/45565/info
MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
MyBB 1.6 is vulnerable; other versions may also be affected.
POST /mybb/search.php
action=do_search&forums=2&keywords='+or+'a'+'a&postthread=1
Exploit-DB
MyBB 1.6 - 'private.php?keywords' SQL Injection
exploitdb·2010-12-23
CVE-2010-5096 MyBB 1.6 - 'private.php?keywords' SQL Injection
MyBB 1.6 - 'private.php?keywords' SQL Injection
---
source: https://www.securityfocus.com/bid/45565/info
MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
MyBB 1.6 is vulnerable; other versions may also be affected.
POST /mybb/private.php
my_post_key=&keywords='+or+'a'+'a&quick_search=Search+PMs&allbox=Check+All&fromfid=0&fid=4&jumpto=4&action=do_stuff
No writeups or analysis indexed.
http://dev.mybb.com/issues/1330http://www.openwall.com/lists/oss-security/2012/03/23/4http://www.openwall.com/lists/oss-security/2012/03/25/1http://www.openwall.com/lists/oss-security/2012/05/08/3http://www.openwall.com/lists/oss-security/2012/05/08/7http://www.osvdb.org/70013http://www.osvdb.org/70014http://www.securityfocus.com/bid/45565http://dev.mybb.com/issues/1330http://www.openwall.com/lists/oss-security/2012/03/23/4http://www.openwall.com/lists/oss-security/2012/03/25/1http://www.openwall.com/lists/oss-security/2012/05/08/3http://www.openwall.com/lists/oss-security/2012/05/08/7http://www.osvdb.org/70013http://www.osvdb.org/70014http://www.securityfocus.com/bid/45565
2012-08-13
Published