MyBB Information Disclosure and SQL Injection Vulnerabilities

Bugtraq ID:	47404
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 18 2011 12:00AM
Updated:	Apr 18 2011 12:00AM
Credit:	thebod and MyBB
Vulnerable:	MyBB MyBB 1.6.2 MyBB MyBB 1.6.1 MyBB MyBB 1.4.15 MyBB MyBB 1.4.14 MyBB MyBB 1.4.10 MyBB MyBB 1.4.9 MyBB MyBB 1.4.8 MyBB MyBB 1.4.7 MyBB MyBB 1.4.6 MyBB MyBB 1.4.5 MyBB MyBB 1.4.3 MyBB MyBB 1.4.2 MyBB MyBB 1.6
Not Vulnerable:	MyBB MyBB 1.6.3 MyBB MyBB 1.4.16

MyBB Information Disclosure and SQL Injection Vulnerabilities

MyBB (MyBulletinBoard) is prone to an information-disclosure vulnerability and an SQL-injection vulnerability.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database and gain access to sensitive information. Other attacks are also possible.

Versions prior to MyBB 1.6.3 and 1.4.16 are vulnerable

MyBB Information Disclosure and SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

MyBB Information Disclosure and SQL Injection Vulnerabilities

Solution:
The vendor released an update. Please see the references for details.

MyBB Information Disclosure and SQL Injection Vulnerabilities

References:

• MyBB 1.6.3 and 1.4.16 Security Update (MyBB)
  
• MyBB Homepage (MyBB)