CVE-2010-5096
MyBB < 1.6.1 - SQL Injection via Search or Private Keywords Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-5096. PoCs published by Aung Khant.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in MyBB 1.6 by injecting malicious input into the search.php endpoint via the 'keywords' parameter. The payload bypasses sanitization and manipulates the SQL query to potentially access or modify data.
Description
Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in a (1) do_search action to search.php or (2) do_stuff action to private.php. NOTE: the vendor disputes this issue, saying "Although this doesn't lead to an SQL injection, it does provide a general MyBB SQL error.
Exploits (2)
This exploit demonstrates a SQL injection vulnerability in MyBB 1.6 by injecting malicious input into the search.php endpoint via the 'keywords' parameter. The payload bypasses sanitization and manipulates the SQL query to potentially access or modify data.
This exploit demonstrates a SQL injection vulnerability in MyBB 1.6 by injecting malicious input into the 'keywords' parameter of a POST request to private.php. The payload bypasses authentication and manipulates the SQL query to potentially access or modify data.