Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

MyBB preview release lets attackers run database commands

CVE-2005-2888 · published 21 years ago
Summary

The preview version of MyBulletinBoard (MyBB) can be tricked into executing unwanted database queries. By sending specially crafted data in a URL parameter or in an email header, an attacker could read, change, or delete information stored by the forum. Update to a patched version or stop using the preview release until it is fixed.

Original advisory text
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) Preview Release 2 allow remote attackers to execute arbitrary SQL commands via the (1) fid parameter to misc.php or (2) Content-Disp...
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) Preview Release 2 allow remote attackers to execute arbitrary SQL commands via the (1) fid parameter to misc.php or (2) Content-Disposition field in the HTTP header to newreply.php.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Timeline
Published14 Sep 2005
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2005-2888 · NVD
Track software like this
Free during beta