Description
Cross-site scripting (XSS) vulnerability in admin/global.php (aka the Admin CP login form) in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the query string ($_SERVER[PHP_SELF]).
References
- 1540 third-party-advisory
- 21697 third-party-advisory
- ADV-2006-3418 vdb-entry
- http://myimei.com/security/2006-08-17/mybb-117-adminglobalphp-xss-attack.html
- 20060830 [KAPDA]MyBB 1.1.7 ~ admin/global.php ~ XSS Attack mailing-list
- http://www.mybboard.com/archive.php?nid=18