Description

SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditions[usergroup][] parameter in a search action to admin/index.php.

Remediation

References

CVE-2012-5909

Related Vulnerabilities

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2009-0257)

WordPress Plugin Multisite Plugin Manager Multiple Cross-Site Scripting Vulnerabilities (3.1.1)

Apache HTTP Server Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2008-2364)

WordPress Plugin Jetpack-WP Security, Backup, Speed, & Growth Cross-Site Scripting (7.9)

Claroline Other Vulnerability (CVE-2006-3257)

Severity

High

Classification

CVE-2012-5909 CWE-138

Tags

Missing Update Known Vulnerabilities