MyBB Moderation.PHP SQL Injection Vulnerability
BID:16538
Info
MyBB Moderation.PHP SQL Injection Vulnerability
| Bugtraq ID: | 16538 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 07 2006 12:00AM |
| Updated: | Dec 13 2006 04:48PM |
| Credit: | imei is credited with the discovery of this vulnerability. |
| Vulnerable: |
MyBulletinBoard MyBulletinBoard 1.0.3 |
| Not Vulnerable: | |
Discussion
MyBB Moderation.PHP SQL Injection Vulnerability
MyBB is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input.
Successful exploitation can allow an attacker to bypass authentication and gain administrative access to a site, modify data, or exploit vulnerabilities in the underlying database implementation. Other attacks may also be possible.
Note that an attacker must have sufficient message moderation and merging privileges to exploit this vulnerability.
MyBB version 1.0.3 is reported to be vulnerable.
MyBB is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input.
Successful exploitation can allow an attacker to bypass authentication and gain administrative access to a site, modify data, or exploit vulnerabilities in the underlying database implementation. Other attacks may also be possible.
Note that an attacker must have sufficient message moderation and merging privileges to exploit this vulnerability.
MyBB version 1.0.3 is reported to be vulnerable.
Exploit / POC
MyBB Moderation.PHP SQL Injection Vulnerability
An exploit is not required.
The following proof of concept example is available:
http://www.example.com/mybb/moderation.php?posts=[firstpid]|[secondpid]?[SQL]
&tid=[containertid]&action=do_multimergeposts&sep=hr
An exploit is not required.
The following proof of concept example is available:
http://www.example.com/mybb/moderation.php?posts=[firstpid]|[secondpid]?[SQL]
&tid=[containertid]&action=do_multimergeposts&sep=hr
Solution / Fix
MyBB Moderation.PHP SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
MyBB Moderation.PHP SQL Injection Vulnerability
References:
References: