Post: #1

MyBB 1.6.3 and 1.4.16 are now available to download. They fix 1 high risk vulnerability and 1 low risk vulnerability. We recommend everyone upgrades to this release immediately or patch their boards with the manual patching instructions below.

Thanks to Charlie Somerville and thebod for discovering them. These vulnerabilities are:

An SQL injection vulnerability in showthread.php (internal report)
Issue #1487 – CSRF vulnerability in misc.php?action=markread

In addition to the vulnerabilities, the updates also fix the following issues:

SQL error on malformed search keywords
IE9 Javascript Issues (1.6.3 only)
MySQL 5.5 compatibility (1.6.3 only)


[More Info]