Description

SQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775.

Remediation

References

CVE-2007-1963

Related Vulnerabilities

WordPress Plugin spam-byebye Cross-Site Scripting (2.2.1)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7875)

MySQL CVE-2021-2356 Vulnerability (CVE-2021-2356)

WordPress Improper Input Validation Vulnerability (CVE-2009-2431)

SugarCRM Other Vulnerability (CVE-2006-6712)

Severity

High

Classification

CVE-2007-1963

Tags

Missing Update Known Vulnerabilities