vulnwire
7.5high

CVE-2005-25804 exploits

Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 with Security Patch allow remote attackers to execute arbitrary S…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.1%
percentile 82%
Public exploits
4
Exploit-DB

Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 with Security Patch allow remote attackers to execute arbitrary SQL commands via the Username field in (1) index.php or (2) member.php, action parameter to (3) search.php or (4) member.php, or (5) polloptions parameter to polls.php.

Exploit prediction (EPSS)

2.08% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.

Exploits and detections

  • EDB-26150 MyBulletinBoard (MyBB) RC4 - 'action' SQL Injection · webapps · 2005-08-12
  • EDB-26149 MyBulletinBoard (MyBB) RC4 - 'polloptions' SQL Injection · webapps · 2005-08-12
  • EDB-26148 MyBulletinBoard (MyBB) RC4 - 'member.php' Multiple SQL Injections · webapps · 2005-08-12
  • EDB-26147 MyBulletinBoard (MyBB) RC4 - 'Username' SQL Injection · webapps · 2005-08-12

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

References

  • securityfocus.com /bid/14553 · vdb-entry, x_refsource_BID, x_transferred
  • marc.info /?l=bugtraq&m=112387501519835&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.