SQL Injection in Mybb Ajax Forum Stat
CVE-2013-6936
Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletinBoard) allow remote attackers to execute arbitrary SQL commands via the (1) tooltip or (2) usertooltip parameter.
Vulnerability class: SQL Injection
EPSS: 0.025 (82.9th percentile) — read the EPSS interpretation.
Affected products
- Mybb Ajax_forum_stat — versions 2.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (Exploit, exploit, x_refsource_EXPLOIT-DB)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (mailing-list, Exploit, x_refsource_BUGTRAQ)