Description
Multiple SQL injection vulnerabilities in YaBB SE 1.5.4 through 1.5.5b allow remote attackers to execute arbitrary SQL via (1) the msg parameter in ModifyMessage.php or (2) the postid parameter in ModifyMessage.php.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Alnitak & BackSpace · textwebappsphp
https://www.exploit-db.com/exploits/23775
References (3)
Core 3
Core References
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=107816202813083&w=2
Exploit, Patch, Vendor Advisory vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/9774
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/15354
Scores
EPSS
0.0038
EPSS Percentile
59.5%
Details
Status
published
Products (3)
yabb/yabb
1.5.4
yabb/yabb
1.5.5
yabb/yabb
1.5.5b
Published
Nov 23, 2004
Tracked Since
Feb 18, 2026