community.mybboard.netConfirmation
http://community.mybboard.net/showthread.php?tid=27675 CVE-2008-0787
MyBulletinBoard (MyBB) 1.2.11 - 'private.php' SQL Injection (1)
Record summary
CVE-2008-0787 has a selected CVSS score of 6.5; EIP currently links 1 catalogued exploit.
Description
SQL injection vulnerability in inc/datahandlers/pm.php in MyBB before 1.2.12 allows remote authenticated users to execute arbitrary SQL commands via the options[disablesmilies] parameter to private.php.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBMyBulletinBoard (MyBB) 1.2.11 - 'private.php' SQL Injection (1)ExploitDB exploitby FNot analyzed1 file
References
928572Third-party advisory
http://secunia.com/advisories/28572 20080121 [waraxe-2008-SA#064] - Sql Injection in MyBB 1.2.11mailing list
http://www.securityfocus.com/archive/1/486763/100/200/threaded 27378vdb entry
http://www.securityfocus.com/bid/27378 1019257vdb entry
http://www.securitytracker.com/id?1019257 ADV-2008-0238vdb entry
http://www.vupen.com/english/advisories/2008/0238 waraxe.us
http://www.waraxe.us/advisory-64.html nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2008-0787 5070exploit
https://www.exploit-db.com/exploits/5070