header-logo
Suggest Exploit
vendor:
AwayList Plugin
by:
Red_Hat [Team Vect0r]
7,5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: AwayList Plugin
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows & Linux
2020

AwayList MyBB plugin SQLi 0day

The AwayList MyBB plugin is vulnerable to a SQL injection vulnerability due to the variable '$mybb->input['id']' remaining unsanitized. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the server, such as http://server/index.php?action=editAwlItem&id=[SQLi].

Mitigation:

Sanitize user input to prevent SQL injection attacks.
Source

Exploit-DB raw data:

# Exploit Title: AwayList MyBB plugin SQLi 0day
# Exploit Author: Red_Hat [Team Vect0r]
# Software Link: http://mods.mybb.com/view/awaylist
# Tested on: Windows & Linux.


Vulnerable code :

<?php
$query = $db->simple_select( // 245
        "awaylist", '*', "id = '" . $mybb->input['id'] . "'" // 246
    ); // 247
    $item = $db->fetch_array($query); // 248
?>

The variable '$mybb->input['id']' remains unsanitized.

Usage : http://server/index.php?action=editAwlItem&id=[SQLi]

Exploit-DB Not:
This is what worked for us: awaylist.php?action=editAwlItem&id=1'

Shoutout to Zixem <3 & Team Vect0r :3

Navigation

Suggest Exploit

Services By CQR