high7.5Public exploit code
CVE-2013-6936
Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletinBoard) allow remote attackers to execut…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- MyBB Ajaxfs 2 Plugin - SQL Injection2013-11-24 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletinBoard) allow remote attackers to execute arbitrary SQL commands via the (1) tooltip or (2) usertooltip parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mybb | Ajax Forum Stat | Version 2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/100030
- http://packetstormsecurity.com/files/124091/MyBB-Ajaxfs-SQL-Injection.html
- http://seclists.org/bugtraq/2013/Nov/102
- http://www.exploit-db.com/exploits/29797
- http://www.iedb.ir/exploits-889.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89084
- http://osvdb.org/100030
- http://packetstormsecurity.com/files/124091/MyBB-Ajaxfs-SQL-Injection.html
- http://seclists.org/bugtraq/2013/Nov/102
- http://www.exploit-db.com/exploits/29797
- http://www.iedb.ir/exploits-889.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89084