Description
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) Preview Release 2 allow remote attackers to execute arbitrary SQL commands via the (1) fid parameter to misc.php or (2) Content-Disposition field in the HTTP header to newreply.php.
References
- 20050907 SQL Injection[2] In MyBB PR2 mailing-list
- mybb-misc-newreply-sql-injection(22192) vdb-entry
- 16738 third-party-advisory