MyBB 1.0 SQL injection in uploading file

CVE Category Price Severity
CWE-89 $5000 High
Author Risk Exploitation Type Date
Unknown High Remote 2006-01-07
CVSS:4.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at:

Below is a copy:

there is a security bug in inc/function_upload.php script in mybb all version (except two days ago security updated version) that allows SQL INJECTION
this bug is in function of upload attachment .
when a file goes to upload this function test that if file has a valid extension . for this call getextension  function and fetch all of characters after last period sign. then make a query and search in valid extensions table and here a file with quoted extension include sql statement will be execute.
this bug reported to mybb offical site and patched as a security patch in internal version 1.0.1 two days ago
be beauty

Copyright ©2024 Exploitalert.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum