MyBB AwayList plugin SQL Injection

2012.12.04

Credit: Red_Hat

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-89

Dork: inurl:\"awaylist.php\"

# Exploit Title: AwayList MyBB plugin SQLi 0day
# Google Dork: inurl:"awaylist.php"
# Exploit Author: Red_Hat [NullSec]
# Software Link: http://mods.mybb.com/view/awaylist
# Tested on: Windows & Linux.
 
Vulnerable code :
 
<?php
$query = $db->simple_select( // 245
        "awaylist", '*', "id = '" . $mybb->input['id'] . "'" // 246
    ); // 247
    $item = $db->fetch_array($query); // 248
?>
 
The variable '$mybb->input['id']' remains unsanitized.
 
Usage : http://www.site.com/index.php?action=editAwlItem&id=[SQLi]
 
Shoutout to Zixem (Checked to see if it worked) <3 & NullSec :3

References:

http://mods.mybb.com/view/awaylist

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

MyBB AwayList plugin SQL Injection

Dork: inurl:\"awaylist.php\"

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.