Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0 have unknown impact and attack vectors, a different set of vulnerabilities than those identified by CVE-2005-4199.

The version of MyBB installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'month' parameter of the calendar.php script. A remote, unauthenticated attacker can exploit this issue to manipulate SQL queries, resulting in the disclosure of sensitive information and modification of data.

Note that the application is also reportedly affected by several additional SQL injection vulnerabilities, many of which can be exploited even if PHP's 'register_globals' setting is disabled and the 'magic_quotes_gpc' setting is enabled. However, Nessus has not tested for these additional issues.

The version of MyBB installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'rating' parameter of the ratethread.php script. A remote attacker can exploit this issue to manipulate SQL queries, resulting in the disclosure of sensitive information and modification of data.

ID	Name	Product	Family	Severity
20342	MyBB calendar.php 'month' Parameter SQLi	Nessus	CGI abuses	critical
19716	MyBB ratethread.php 'rating' Parameter SQLi	Nessus	CGI abuses	high

Detections

Analytics

CVE-2005-4200

critical

Tenable Plugins

critical

high