CVE-2006-3758: SQL Injection

Published Jul 21, 2006

Updated

inc/init.php in Archive Mode (Light) in MyBB (aka MyBulletinBoard) 1.1.4 calls the extract function with EXTROVERWRITE on HTTP POST and GET variables, which allows remote attackers to overwrite arbitrary variables, as demonstrated via an SQL injection using the SERVER[HTTPCLIENTIP] parameter in archive/index.php.

Affected Software

1 affected component

MyBulletinBoard MyBulletinBoard=1.1.4

Remediation

Patch Available

http://secunia.com/advisories/20873

Event History

Jul 21, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3758?

CVE-2006-3758 has a medium severity due to its ability to allow remote attackers to overwrite arbitrary variables.

How do I fix CVE-2006-3758?

To fix CVE-2006-3758, you should upgrade to MyBB version 1.1.5 or later, where this vulnerability has been addressed.

What software is affected by CVE-2006-3758?

CVE-2006-3758 specifically affects MyBB version 1.1.4.

What type of attack does CVE-2006-3758 enable?

CVE-2006-3758 enables remote attackers to exploit variable overwriting for potential SQL injection attacks.

How does CVE-2006-3758 impact MyBB users?

CVE-2006-3758 can compromise the security of MyBB users by allowing unauthorized access to sensitive data through variable manipulation.