CVE-2006-0959
MyBulletinBoard 1.03-1.04 - SQL Injection via Cookie Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-0959. PoCs published by Devil-00.
AI-analyzed exploit summary This exploit targets a SQL injection vulnerability in MyBB <= 1.04 via the 'misc.php' script. It injects a malicious SQL query through the 'comma' cookie parameter to extract the login key of a specified user.
Description
SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands by setting the comma variable value via the comma parameter in a cookie. NOTE: 1.04 has also been reported to be affected.
Exploits (2)
This exploit targets a SQL injection vulnerability in MyBB <= 1.04 via the 'misc.php' script. It injects a malicious SQL query through the 'comma' cookie parameter to extract the login key of a specified user.
This exploit demonstrates a SQL injection vulnerability in MyBB 1.3 when register_globals is enabled. The attack leverages an unset $_COOKIE variable to inject malicious SQL via the 'comma' cookie, bypassing authentication and extracting sensitive data.