CVE-2005-4199

MyBB < 1.0 - SQL Injection via Calendar and User Profile Parameters

Title source: llm

Description

Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options action in usercp.php; (6) list parameter in an editlists action to usercp.php; (7) rating parameter in a rate action in member.php; and (8) rating parameter in either showthread.php or ratethread.php.

References (15)

Core 15

Core References

Patch vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/15793

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/22158

Patch, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/18000

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/22156

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/419067/100/0/threaded

Patch x_refsource_misc

http://www.trapkit.de/advisories/TKPN2005-12-001.txt

Third Party Advisory third-party-advisory x_refsource_sreason

http://securityreason.com/securityalert/246

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1015407

Various Sources x_refsource_confirm

http://community.mybboard.net/showthread.php?tid=5184&pid=30964#pid30964

Third Party Advisory mailing-list x_refsource_fulldisc

http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0379.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/22157

Various Sources x_refsource_misc

http://www.trapkit.de/advisories/TKADV2005-12-001.txt

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/420159/100/0/threaded

Third Party Advisory third-party-advisory x_refsource_sreason

http://securityreason.com/securityalert/294

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2005/2842

Scores

EPSS 0.0206

EPSS Percentile 79.4%

Details

CWE

CWE-89

Status published

Products (2)

mybb/mybb 1.0 beta4 (6 CPE variants)

mybb/mybb < 1.0

Published Dec 13, 2005

Tracked Since Feb 18, 2026