CVE:CVE-2007-1964
CNNVD:CNNVD-200704-201
当debug模式可用时，MyBB(又称MyBulletinBoard)中的member.php存在权限许可和访问控制漏洞。远程认证用户可以通过在对do_lostpw操作的debug请求中提供账户的注册电子邮箱地址，更改任意账户的密码。
solution:Upgrade mybb mybb to a higher version than 1.2.5,and avoid the version 1.2.5; Upgrade mybulletinboard mybulletinboard to a higher version than 1.2.5,and avoid the version 1.2.5