MyBB Multiple SQL Injection and Cross Site Scripting Vulnerabilities

Bugtraq ID:	64570
Class:	Input Validation Error
CVE:	CVE-2013-7275 CVE-2013-7288
Remote:	Yes
Local:	No
Published:	Dec 30 2013 12:00AM
Updated:	Jan 14 2014 12:32AM
Credit:	ChALkeR, Spenzert
Vulnerable:	MyBB MyBB 1.6.8 MyBB MyBB 1.6.7 MyBB MyBB 1.6.6 MyBB MyBB 1.6.5 MyBB MyBB 1.6.4 MyBB MyBB 1.6.2 MyBB MyBB 1.6.1 MyBB MyBB 1.4.10 MyBB MyBB 1.4.9 MyBB MyBB 1.4.8 MyBB MyBB 1.4.7 MyBB MyBB 1.4.6 MyBB MyBB 1.4.5 MyBB MyBB 1.4.3 MyBB MyBB 1.4.2 MyBB MyBB 1.2.14 MyBB MyBB 1.2.12 MyBB MyBB 1.2.2 MyBB MyBB 1.2.1 MyBB MyBB 1.2
Not Vulnerable:

MyBB Multiple SQL Injection and Cross Site Scripting Vulnerabilities

MyBB is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to MyBB 1.6.12 are vulnerable.

MyBB Multiple SQL Injection and Cross Site Scripting Vulnerabilities

Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issues, an attacker must entice an unsuspecting user into following a malicious URI.

MyBB Multiple SQL Injection and Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

MyBB Multiple SQL Injection and Cross Site Scripting Vulnerabilities

References:

• MyBB Homepage (MyBB)