high7.5Public exploit code
CVE-2007-1963
SQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and earlier allows remote attackers to exec…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- MyBulletinBoard (MyBB) 1.2.3 - Remote Code Execution2007-04-03 · webapps · php · Verified
Impact
SQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mybb | Mybb | through 1.2.3 |
| Mybulletinboard | Mybulletinboard | through 1.2.3 |
References
- NVD record
- CVE.org record
- http://community.mybboard.net/attachment.php?aid=5842
- http://community.mybboard.net/showthread.php?tid=18002
- http://osvdb.org/34657
- http://secunia.com/advisories/24689
- http://www.securityfocus.com/archive/1/464563/100/0/threaded
- http://www.vupen.com/english/advisories/2007/1244
- https://www.exploit-db.com/exploits/3653
- http://community.mybboard.net/attachment.php?aid=5842
- http://community.mybboard.net/showthread.php?tid=18002
- http://osvdb.org/34657
- http://secunia.com/advisories/24689
- http://www.securityfocus.com/archive/1/464563/100/0/threaded
- http://www.vupen.com/english/advisories/2007/1244
- https://www.exploit-db.com/exploits/3653