CVE-2016-9416 SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via unspec...
CriticalCVSS 9.8
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mybb merge system | <= 1.8.7 | No fix listed |
| mybb | <= 1.8.7 | No fix listed |
References
- [oss-security] 20161110 CVE request: MyBB multiple vulnerabilities mailing-list patch third-party-advisory
- [oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities mailing-list patch third-party-advisory
- 94396 third-party-advisory vdb-entry
- blog.mybb.com patch release-notes vendor-advisory