CVE-2005-4199: SQL Injection
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options action in usercp.php; (6) list parameter in an editlists action to usercp.php; (7) rating parameter in a rate action in member.php; and (8) rating parameter in either showthread.php or ratethread.php.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-4199?
CVE-2005-4199 is considered a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2005-4199?
To fix CVE-2005-4199, upgrade your MyBulletinBoard (MyBB) installation to version 1.0 or later, which patches the identified SQL injection vulnerabilities.
Which versions are affected by CVE-2005-4199?
CVE-2005-4199 affects MyBB versions prior to 1.0, including version 1.0-rc2, 1.0-rc3, 1.0-rc4, and earlier beta versions.
Can CVE-2005-4199 be exploited remotely?
Yes, CVE-2005-4199 can be exploited remotely by attackers via specific input parameters in MyBB, enabling unauthorized SQL commands.
What are some common attack vectors for CVE-2005-4199?
Common attack vectors for CVE-2005-4199 include manipulating the month, day, year parameters in calendar.php and threadmode, showcodebuttons in usercp.php.