CVE-2012-2324

MyBB < 1.6.7 - Authenticated SQL Injection via Admin Control Panel

Title source: llm
STIX 2.1

Description

Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.7 allow remote administrators to execute arbitrary SQL commands via unspecified vectors in the (1) user search or (2) Mail Log in the Admin Control Panel (ACP).

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/53417
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/05/07/13
Patch, Vendor Advisory x_refsource_confirm
http://blog.mybb.com/2012/04/01/mybb-1-6-7-update-1-8-development/
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/05/07/14

Scores

EPSS 0.0105
EPSS Percentile 60.7%

Details

CWE
CWE-89
Status published
Products (44)
mybb/mybb 1.00
mybb/mybb 1.0 beta4 (7 CPE variants)
mybb/mybb 1.01
mybb/mybb 1.1.0
mybb/mybb 1.1.1
mybb/mybb 1.1.2
mybb/mybb 1.1.3
mybb/mybb 1.1.4
mybb/mybb 1.1.5
mybb/mybb 1.1.6
... and 34 more
Published Aug 13, 2012
Tracked Since Feb 18, 2026