Detections
Analytics

MyBB < 1.4.12 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 5513

Synopsis

The remote web server is running a PHP application that is vulnerable to multiple attack vectors.

Description

The remote web server is running a version of MyBB earlier than 1.4.12. Such versions are potentially affected by multiple issues :

- There is a weakness in the mechanism for generating random passwords. (Bug 843)

 - It is possible to inject arbitrary headers into email sent to MyBB users.

 - An unspecified XSRF issue exists in the usercp2.php script. (Bug 852)

Solution

Upgrade to MyBB 1.4.12 or later.

See Also

http://www.sektioneins.com/en/advisories/advisory-012010-mybb-password-reset-email-bcc-injection-vulnerability

http://www.sektioneins.com/en/advisories/advisory-022010-mybb-password-reset-weak-random-numbers-vulnerability

http://blog.mybboard.net/2010/04/13/mybb-1-4-12-released-security-maintenance-update

Plugin Details

Severity: High

ID: 5513

Family: CGI

Published: 4/19/2010

Updated: 3/6/2019

Vulnerability Information

Patch Publication Date: 4/13/2010

Vulnerability Publication Date: 4/13/2010

Reference Information

BID: 39400, 39402, 39404