SQL Injection Vulnerability in MyBB Forum Software
CVE-2021-27946

8.8HIGH

Key Information:

Vendor

Mybb

Status
Mybb
Vendor
CVE Published:
15 March 2021

What is CVE-2021-27946?

A SQL Injection vulnerability exists in MyBB prior to version 1.8.26 that allows attackers to manipulate poll vote counts. This could potentially lead to unauthorized data access or tampering with the poll results, affecting the integrity and trustworthiness of the forum platform. Users utilizing earlier MyBB versions should upgrade to mitigate the risk associated with this vulnerability.

References

https://github.com/mybb/mybb/security/advisories/GHSA-23m...
x_refsource_MISC
http://packetstormsecurity.com/files/161918/MyBB-1.8.25-S...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.