MyBB Multiple Input Validation Vulnerabilities

Bugtraq ID:	18702
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 28 2006 12:00AM
Updated:	Jun 28 2006 10:19PM
Credit:	imei addmimistrator is credited with the discovery of these vulnerabilities.
Vulnerable:	MyBulletinBoard MyBulletinBoard 1.1.4 MyBulletinBoard MyBulletinBoard 1.1.3
Not Vulnerable:	MyBulletinBoard MyBulletinBoard 1.1.5

MyBB Multiple Input Validation Vulnerabilities

MyBB is prone to multiple input-validation vulnerabilities, including cross-site scripting and parameter-extraction issues, because the application fails to properly sanitize user-supplied input.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify sensitive information, or steal cookie-based authentication credentials. Other attacks are also possible.

MyBB Multiple Input Validation Vulnerabilities

These issues can be exploited through a web client.

The following proof-of-concept URIs are available:

• /data/vulnerabilities/exploits/myBBMultipleInputValJune282006.html

MyBB Multiple Input Validation Vulnerabilities

Solution:
The vendor has released a patch for these issues; please see the reference section for details.

MyBB Multiple Input Validation Vulnerabilities

References:

• MyBulletinBoard Homepage (MyBulletinBoard)
  
• MyBB 1.1.4~function_post.php~XSS Attack In URL tag ([email protected])