CVE-2009-2230: SQL Injection
Published Jun 26, 2009
·Updated
SQL injection vulnerability in inc/datahandlers/user.php in MyBB (aka MyBulletinBoard) before 1.4.7 allows remote authenticated users to execute arbitrary SQL commands via the birthdayprivacy parameter.
Affected Software
22 affected components
MyBulletinBoard MyBulletinBoard=1.4.3
MyBulletinBoard MyBulletinBoard=1.2.3
MyBulletinBoard MyBulletinBoard=1.0
MyBulletinBoard MyBulletinBoard=1.4.5
MyBulletinBoard MyBulletinBoard=1.1.8
MyBulletinBoard MyBulletinBoard=1.2
MyBulletinBoard MyBulletinBoard<=1.4.6
MyBulletinBoard MyBulletinBoard=1.2.5
MyBulletinBoard MyBulletinBoard=1.1.6
MyBulletinBoard MyBulletinBoard=1.1.3
MyBulletinBoard MyBulletinBoard=1.2.11
MyBulletinBoard MyBulletinBoard=1.2.10
MyBulletinBoard MyBulletinBoard=1.4.2
MyBulletinBoard MyBulletinBoard=1.0.3
MyBulletinBoard MyBulletinBoard=1.1.5
MyBulletinBoard MyBulletinBoard=1.1
MyBulletinBoard MyBulletinBoard=1.1.4
MyBulletinBoard MyBulletinBoard=1.0.1
MyBulletinBoard MyBulletinBoard=1.0.4
MyBulletinBoard MyBulletinBoard=1.1.2
MyBulletinBoard MyBulletinBoard=1.0.2
MyBulletinBoard MyBulletinBoard=1.1.7
Remediation
Patch Available
Patch Available
Patch Available
Event History
Jun 26, 2009
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2230?
CVE-2009-2230 is classified as a moderate severity SQL injection vulnerability.
2
How do I fix CVE-2009-2230?
To fix CVE-2009-2230, upgrade MyBB to version 1.4.7 or later.
3
What software is affected by CVE-2009-2230?
CVE-2009-2230 affects MyBB versions prior to 1.4.7, including versions 1.0 to 1.4.6.
4
Can CVE-2009-2230 be exploited by unauthenticated users?
No, CVE-2009-2230 can only be exploited by remote authenticated users.
5
What kind of attacks can be executed through CVE-2009-2230?
CVE-2009-2230 allows attackers to execute arbitrary SQL commands.