SQL Injection in Mybb

CVE-2010-5096

Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in a (1) do_search action to search.php or (2) do_stuff action to private.php. NOTE: the vendor disputes this issue, saying "Although this doesn't lead to an SQL injection, it does provide a general MyBB SQL error.

Vulnerability class: SQL Injection

EPSS: 0.056 (92.1th percentile) — read the EPSS interpretation.

Affected products

  • Mybb — versions 1.00, 1.0, 1.01
  • N/a — versions n/a

Weakness classification (CWE)

References