----------------------------------------------------------------------

Do you have VARM strategy implemented?

(Vulnerability Assessment Remediation Management)  

If not, then implement it through the most reliable vulnerability
intelligence source on the market. 

Implement it through Secunia. 

For more information visit:
http://secunia.com/advisories/business_solutions/

Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com

----------------------------------------------------------------------

TITLE:
MyBB Username Spoofing and SQL Injection Vulnerabilities

SECUNIA ADVISORY ID:
SA36803

VERIFY ADVISORY:
http://secunia.com/advisories/36803/

DESCRIPTION:
A security issue and a vulnerability have been reported in MyBB,
which can be exploited by malicious users to conduct spoofing and SQL
injection attacks.

1) Input passed via avatar extensions is not properly sanitised
before being used in SQL queries. This can be exploited to manipulate
SQL queries by uploading specially named avatars.

2) The script allows to sign up with usernames containing zero width
space characters, which can be exploited to e.g. conduct spoofing
attacks.

Note: Additionally, an error within the Custom MyCode implementation
can allow administrators to use eval expressions.

SOLUTION:
Update to version 1.4.9 or apply patches.

Latest version:
http://mybboard.net/download/latest

Patched files:
http://mybboard.net/download/109

Manual patch instructions:
http://mybboard.net/download/110

PROVIDED AND/OR DISCOVERED BY:
The vendor credits endeavormac, frostschutz, and TheLinx.

ORIGINAL ADVISORY:
http://blog.mybboard.net/2009/09/21/mybb-1-4-9-released-security-update/

1) http://dev.mybboard.net/issues/464
2) http://dev.mybboard.net/issues/418

http://dev.mybboard.net/issues/317

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------