Description

SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditions[usergroup][] parameter in a search action to admin/index.php.

Remediation

References

CVE-2012-5909

Related Vulnerabilities

WordPress Plugin BulletProof Security Cross-Site Scripting (.53.3)

WordPress Plugin WP Photo Album Plus 'wppa-album' Parameter SQL Injection (4.1.1)

Oracle Database Server CVE-2014-4295 Vulnerability (CVE-2014-4295)

Python Data Processing Errors Vulnerability (CVE-2013-7440)

WordPress Plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) SQL Injection (1.5.109)

Severity

High

Classification

CVE-2012-5909 CWE-138

Tags

Missing Update Known Vulnerabilities