CVE-2006-3243: SQL Injection

Published Jun 27, 2006

Updated

SQL injection vulnerability in usercp.php in MyBB (MyBulletinBoard) 1.0 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the showcodebuttons parameter.

Affected Software

20 affected components

MyBulletinBoard MyBulletinBoard=1.0_final

MyBulletinBoard MyBulletinBoard=1.1.1

MyBulletinBoard MyBulletinBoard=1.0_rc4

MyBulletinBoard MyBulletinBoard=1.00_rc4

MyBulletinBoard MyBulletinBoard=1.00_rc3

MyBulletinBoard MyBulletinBoard=1.1.3

MyBulletinBoard MyBulletinBoard=1.0.3

MyBulletinBoard MyBulletinBoard=1.00_rc4_security_patch

MyBulletinBoard MyBulletinBoard=1.04

MyBulletinBoard MyBulletinBoard=1.01

MyBulletinBoard MyBulletinBoard=1.00_rc1

MyBulletinBoard MyBulletinBoard=1.0_pr2

MyBulletinBoard MyBulletinBoard=1.00_rc2

MyBulletinBoard MyBulletinBoard=1.1

MyBulletinBoard MyBulletinBoard=1.0.1

MyBulletinBoard MyBulletinBoard=1.0.4

MyBulletinBoard MyBulletinBoard=1.1.2

MyBulletinBoard MyBulletinBoard=1.0.2

MyBulletinBoard MyBulletinBoard=1.0_rc2

MyBulletinBoard MyBulletinBoard=1.0_preview_release_2

Remediation

Patch Available

http://secunia.com/advisories/20795

Event History

Jun 27, 2006

CVE Published

10:05 AM

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3243?

CVE-2006-3243 is considered a medium severity vulnerability due to its potential to allow attackers to execute arbitrary SQL commands.

How do I fix CVE-2006-3243?

To fix CVE-2006-3243, upgrade MyBB to a version greater than 1.1.3, as later versions address this SQL injection vulnerability.

What software versions are affected by CVE-2006-3243?

CVE-2006-3243 affects MyBB versions 1.0 through 1.1.3, including various release candidates and updates.

Can CVE-2006-3243 lead to data breaches?

Yes, CVE-2006-3243 can potentially lead to data breaches as it allows attackers to execute arbitrary SQL commands against the database.

Is there a workaround for CVE-2006-3243 if I cannot upgrade?

If upgrading is not possible, you may implement input validation and parameterized queries to mitigate the risk of SQL injection associated with CVE-2006-3243.