mybb v1.1.1 suffers from SQL injection in showthread.php
bedb5319cc52825b7730f0cea7db322a713a655e3b020356c1f9a429cb998c4a----------------------------------
foud by: Breeeeh
Site: http://www.alshmokh.com
Email: Breeeeh@hotmail.com
----------------------------------
$query = $db->query("SELECT pid FROM ".TABLE_PREFIX."posts WHERE tid='$tid' $visible ORDER BY dateline LIMIT $start, $perpage");
while($getid = $db->fetch_array($query)) {
$pids .= "$comma'$getid[pid]'";
$comma = ",";
}
-------------------
example:
/showthread.php?...$comma=[SQL]
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed