bugtraq - MyBB 1.0 SQL injection in uploading file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: 31 Dec 2005 09:55:51 -0000
From: addmimistrator@...il.com
To: bugtraq@...urityfocus.com
Subject: MyBB 1.0 SQL injection in uploading file

Hey
there is a security bug in inc/function_upload.php script in mybb all version (except two days ago security updated version) that allows SQL INJECTION
this bug is in function of upload attachment .
when a file goes to upload this function test that if file has a valid extension . for this call getextension  function and fetch all of characters after last period sign. then make a query and search in valid extensions table and here a file with quoted extension include sql statement will be execute.
this bug reported to mybb offical site and patched as a security patch in internal version 1.0.1 two days ago
be beauty
imei