MyBB Multiple Vulnerabilities

Bugtraq ID:	36463
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 21 2009 12:00AM
Updated:	Sep 21 2009 04:50PM
Credit:	endeavormac, frostschutz, and TheLinx.
Vulnerable:	MyBB MyBB 1.4.8 MyBB MyBB 1.2
Not Vulnerable:	MyBB MyBB 1.4.9

MyBB Multiple Vulnerabilities

MyBB is prone to multiple vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to carry out SQL-injection attacks and register accounts using existing usernames of other users.

MyBB 1.4.8 and 1.2 are affected; other versions may be vulnerable as well.

MyBB Multiple Vulnerabilities

An attacker can exploit these issues via a browser.

MyBB Multiple Vulnerabilities

Solution:
The vendor has released MyBB 1.4.9 to address these issues. Please see the references for details.


MyBB MyBB 1.2

• MyBB MyBB 1.4.9
  http://mybboard.net/download/latest

MyBB MyBB 1.4.8

• MyBB MyBB 1.4.9
  http://mybboard.net/download/latest

MyBB Multiple Vulnerabilities

References:

• Invalid avatar extensions (MyBB)
  
• Zero-width spaces allowed in usernames (MyBB)
  
• MyBB 1.4.9 Released �?? Security Update (MyBB)