CVE-2005-4199

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-12-13 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options action in usercp.php; (6) list parameter in an editlists action to usercp.php; (7) rating parameter in a rate action in member.php; and (8) rating parameter in either showthread.php or ratethread.php.

Affected products

mybb: through 1.0; 1.0-beta4, 1.0-pr1, 1.0-rc1, 1.0-rc2, 1.0-rc3, 1.0-rc4

References

http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0379.html
http://community.mybboard.net/showthread.php?tid=5184&pid=30964#pid30964
http://secunia.com/advisories/18000
http://securityreason.com/securityalert/246
http://securityreason.com/securityalert/294
http://securitytracker.com/id?1015407
http://www.osvdb.org/22156
http://www.osvdb.org/22157
http://www.osvdb.org/22158
http://www.securityfocus.com/archive/1/419067/100/0/threaded
http://www.securityfocus.com/archive/1/420159/100/0/threaded
http://www.securityfocus.com/bid/15793

Get alerted when CVE-2005-4199 or the next vulnerability affects your stack