CVE-2006-0959: SQL Injection
SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when registerglobals is enabled, allows remote attackers to execute arbitrary SQL commands by setting the comma variable value via the comma parameter in a cookie. NOTE: 1.04 has also been reported to be affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0959?
CVE-2006-0959 is considered a high severity vulnerability due to the potential for remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2006-0959?
To fix CVE-2006-0959, disable register_globals in your PHP configuration and upgrade MyBulletinBoard to version 1.0.5 or later.
What versions of MyBulletinBoard are affected by CVE-2006-0959?
CVE-2006-0959 affects MyBulletinBoard versions 1.0.3 and 1.0.4.
Can CVE-2006-0959 lead to data loss?
Yes, CVE-2006-0959 can lead to data loss as it allows attackers to perform arbitrary SQL commands, potentially modifying or deleting data.
Is there a patch available for CVE-2006-0959?
There is not a specific patch for CVE-2006-0959; the recommended action is to update to a newer version of MyBulletinBoard that addresses the vulnerability.