2013-11-09, 02:33 PM
2013-11-09, 04:06 PM
Prostats is only vulnerable from within the admin panel, since it does not sanitize user input on its configuration page. There are, from what I've heard, other similar vulnerabilities from within the admin panel for MyBB as well. They don't generally put your forum at significant risk because someone would need to gain access to your admin panel before they could exploit them.
2013-11-09, 07:29 PM
While this though is generally correct, certain vulnerabilities are dangerous even in the ACP. Recently an user reported that his site was completely hacked and after some researches we pointed out that iShare was used as an injection vector by the hackers who, thanks to an unsanitized upload process, were able to upload a shell script and thus wipe out the entire user's site, not just his MyBB copy.
SQL Injections like this are not dangerous for your site because eventual attackers would have already had access to your admin panel, meaning that they would be able to cause worse damages, definitely.
SQL Injections like this are not dangerous for your site because eventual attackers would have already had access to your admin panel, meaning that they would be able to cause worse damages, definitely.