MyBB Client-IP SQL Injection Vulnerability

Bugtraq ID:	18997
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 15 2006 12:00AM
Updated:	Apr 03 2007 08:12PM
Credit:	Discovery is credited to rgod.
Vulnerable:	MyBulletinBoard MyBulletinBoard 1.2.3 MyBulletinBoard MyBulletinBoard 1.1.5 MyBulletinBoard MyBulletinBoard 1.1.4 MyBulletinBoard MyBulletinBoard 1.1.3 MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBulletinBoard 1.1.1 MyBulletinBoard MyBulletinBoard 1.1 MyBulletinBoard MyBulletinBoard 1.0.4 MyBulletinBoard MyBulletinBoard 1.0.3 MyBulletinBoard MyBulletinBoard 1.0.2 MyBulletinBoard MyBulletinBoard 1.0.1 MyBulletinBoard MyBulletinBoard 1.0 PR2 MyBulletinBoard MyBulletinBoard 1.0 MyBulletinBoard MyBulletinBoard 1.10
Not Vulnerable:

MyBB Client-IP SQL Injection Vulnerability

MyBB is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful attack could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Versions 1.2.3 and prior are affected; other versions may also be possible.

MyBB Client-IP SQL Injection Vulnerability

An exploit has been released for this vulnerability.

• /data/vulnerabilities/exploits/mybb-clientip-sqlinjection.php
• /data/vulnerabilities/exploits/18997.php

MyBB Client-IP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

MyBB Client-IP SQL Injection Vulnerability

References:

• MyBulletinBoard Home Page (MyBulletinBoard)
  
• MyBulletinBoard (MyBB) <= 1.2.3 Remote Code Execution Exploit (DarkFig)
  
• MyBulletinBoard (MyBB) 1.1.5 'CLIENT-IP' sql injection ([email protected])