CVE-2005-2580
MyBulletinBoard 1.00 RC4 - SQL Injection via Username Field or Action Parameter
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2005-2580. PoCs published by phuket.
AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in MyBulletinBoard's admin/index.php, allowing an attacker to bypass authentication by injecting a malicious SQL query into the username field. The payload ' or 1=1 /* manipulates the SQL query to return true, granting administrative access without valid credentials.
Description
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 with Security Patch allow remote attackers to execute arbitrary SQL commands via the Username field in (1) index.php or (2) member.php, action parameter to (3) search.php or (4) member.php, or (5) polloptions parameter to polls.php.
Exploits (4)
This exploit demonstrates an SQL injection vulnerability in MyBulletinBoard's admin/index.php, allowing an attacker to bypass authentication by injecting a malicious SQL query into the username field. The payload ' or 1=1 /* manipulates the SQL query to return true, granting administrative access without valid credentials.
The provided text describes a SQL injection vulnerability in MyBulletinBoard, specifically in the polls.php file. It outlines the vulnerability's impact and provides a sample exploit URL but lacks executable code.
This is a writeup describing SQL injection vulnerabilities in MyBulletinBoard. It provides examples of vulnerable URLs but does not include executable exploit code.
The provided text describes a SQL injection vulnerability in MyBulletinBoard, detailing the lack of input sanitization and potential impacts, including administrative access. It includes a generic example URL for exploitation but lacks executable code.