Chris Boulton

**Name of the Vulnerable Software and Affected Versions** XennoBB versions 2.2.1 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `icon topic` parameter in the topic post.php file. **Recommendations** For XennoBB versions 2.2.1 and earlier, update to a version later than 2.2.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** XennoBB versions 2.1.0 and earlier **Description** The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the avatar gallery action in profile.php. This is achieved by using a .. (dot dot) in the `category` parameter. **Recommendations** For XennoBB versions 2.1.0 and earlier, as a temporary workaround, consider restricting access to the avatar gallery action in profile.php until a patch is available. Avoid using the `category` parameter with unvalidated input in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** XennoBB versions 2.1.0 and earlier **Description** The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the `bday day`, `bday month`, and `bday year` parameters in the personal section of the profile.php file. **Recommendations** For XennoBB versions 2.1.0 and earlier, consider restricting access to the personal section of profile.php until a fix is available, and avoid using the `bday day`, `bday month`, and `bday year` parameters to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MyBB versions prior to 1.03 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `templatelist` variable in the global.php file. **Recommendations** For versions prior to 1.03, update to version 1.03 or later to resolve the issue. As a temporary workaround, consider restricting access to the `templatelist` variable in the global.php file until a patch is available.

Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0.2 have unspecified impact and attack vectors, related to (1) admin/moderate.php, (2) admin/themes.php, (3) inc/functions.php, (4) inc/functions upload.php, (5) printthread.php, and (6) usercp.php, and probably related to SQL injection. NOTE: it is likely that this issue subsumes CVE-2005-4602 and CVE-2005-4603. However, since the vendor advisory is vague and additional files are mentioned, is is likely that this contains at least one distinct vulnerability from CVE-2005-4602 and CVE-2005-4603.

**Name of the Vulnerable Software and Affected Versions** MyBulletinBoard (MyBB) versions prior to 1.0 PR2 Rev 686 **Description** The issue allows attackers to cause a denial of service via unknown vectors. **Recommendations** For versions prior to 1.0 PR2 Rev 686, update to version 1.0 PR2 Rev 686 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MyBB (affected versions not specified) **Description** A SQL injection issue exists, allowing remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `awayday` parameter in the `usercp.php` file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.