Exploitation Summary
EIP tracks 1 public exploit for CVE-2007-1963. PoCs published by DarkFig.
AI-analyzed exploit summary This exploit targets a SQL injection vulnerability in MyBulletinBoard (MyBB) <= 1.2.3, leveraging blind SQL injection via the 'Client-IP' header to extract admin session details and achieve remote code execution by uploading a malicious PHP backdoor.
Description
SQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775.
Exploits (1)
This exploit targets a SQL injection vulnerability in MyBulletinBoard (MyBB) <= 1.2.3, leveraging blind SQL injection via the 'Client-IP' header to extract admin session details and achieve remote code execution by uploading a malicious PHP backdoor.