CVEvulnerability
CVE-2015-8974
10.0 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-01-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 10.0 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected configurations
• mybb merge system (<= 1.8.5)
• mybb mybb (<= 1.6.17)
• mybb mybb 1.8.0
• mybb mybb 1.8.1
• mybb mybb 1.8.2
• mybb mybb 1.8.3
• mybb mybb 1.8.4
• mybb mybb 1.8.5
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://www.openwall.com/lists/oss-security/2016/11/10/8 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/11/18/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/94397 Third Party Advisory, VDB Entry
- https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/ Release Notes, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2016/11/10/8 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/11/18/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/94397 Third Party Advisory, VDB Entry
- https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/ Release Notes, Vendor Advisory