Hey there is a security bug in inc/function_upload.php script in mybb all version (except two days ago security updated version) that allows SQL INJECTION this bug is in function of upload attachment . when a file goes to upload this function test that if file has a valid extension . for this call getextension function and fetch all of characters after last period sign. then make a query and search in valid extensions table and here a file with quoted extension include sql statement will be execute. this bug reported to mybb offical site and patched as a security patch in internal version 1.0.1 two days ago be beauty imei
