MyBB editpost. php script 'posthash' parameter SQL Injection Vulnerability

Release date:
Updated on:

Affected Systems:
MyBB 1.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56960

MyBB is a fully functional and practical forum software.

The editpost. php script of versions earlier than MyBB 1.6.9 does not correctly verify the validity of the "posthash" parameter, which can cause the SQL injection vulnerability. Remote attackers can execute arbitrary database operations through SQL statements.

<* Source: frostschutz
StefanT

Link: http://secunia.com/advisories/51592/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

MyBB
----
The vendor has released a patch to fix this security problem. Please download version 1.6.9 from the vendor's homepage:

Http://resources.mybb.com/downloads/mybb_1609.zip