CVE:CVE-2007-0689
CNNVD:CNNVD-200705-262
MyBB 允许远程攻击者借助提交到member.php的(1)action[]参数、到captcha.php的(2)imagehash[]参数和到inc/datahandlers/event.php的(3)一个直接请求，获得敏感信息。它会在错误信息中显示安装路径。
solution:Upgrade mybb mybb to a higher version than 1.2.4,and avoid the version (,1.2.4]