CVE-2005-4199
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5)…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.06%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options action in usercp.php; (6) list parameter in an editlists action to usercp.php; (7) rating parameter in a rate action in member.php; and (8) rating parameter in either showthread.php or ratethread.php.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 2.06% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- mybb/mybb
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0379.html
- http://community.mybboard.net/showthread.php?tid=5184&pid=30964#pid30964
- http://secunia.com/advisories/18000Patch, Vendor Advisory
- http://securityreason.com/securityalert/246
- http://securityreason.com/securityalert/294
- http://securitytracker.com/id?1015407
- http://www.osvdb.org/22156
- http://www.osvdb.org/22157
- http://www.osvdb.org/22158
- http://www.securityfocus.com/archive/1/419067/100/0/threaded
- http://www.securityfocus.com/archive/1/420159/100/0/threaded
- http://www.securityfocus.com/bid/15793Patch
- http://www.trapkit.de/advisories/TKADV2005-12-001.txt
- http://www.trapkit.de/advisories/TKPN2005-12-001.txtPatch
- http://www.vupen.com/english/advisories/2005/2842Vendor Advisory
- http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0379.html
- http://community.mybboard.net/showthread.php?tid=5184&pid=30964#pid30964
- http://secunia.com/advisories/18000Patch, Vendor Advisory
- http://securityreason.com/securityalert/246
- http://securityreason.com/securityalert/294
- http://securitytracker.com/id?1015407
- http://www.osvdb.org/22156
- http://www.osvdb.org/22157
- http://www.osvdb.org/22158
- http://www.securityfocus.com/archive/1/419067/100/0/threaded
- http://www.securityfocus.com/archive/1/420159/100/0/threaded
- http://www.securityfocus.com/bid/15793Patch
- http://www.trapkit.de/advisories/TKADV2005-12-001.txt
- http://www.trapkit.de/advisories/TKPN2005-12-001.txtPatch
- http://www.vupen.com/english/advisories/2005/2842Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.