CVE-2013-6936

EPSS 2.5%

Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletinBoard) allow remote attackers to execute arbitrary SQL commands via the (1) tooltip or (2) usertooltip parameter.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/124091/MyBB-Ajaxfs-SQL-Injection.htmlunverified cve_referencewww.exploit-db.com/exploits/29797unverified exploitdbwww.exploit-db.com/exploits/29797unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/100030 http://packetstormsecurity.com/files/124091/MyBB-Ajaxfs-SQL-Injection.html http://seclists.org/bugtraq/2013/Nov/102 https://exchange.xforce.ibmcloud.com/vulnerabilities/89084 http://www.exploit-db.com/exploits/29797 http://www.iedb.ir/exploits-889.html