header-logo
Suggest Exploit
vendor:
MyBB
by:
Joshua Rogers
8,8
CVSS
HIGH
Stored, Error based, SQL Injection
89
CWE
Product Name: MyBB
Affected Version From: 1.6.9
Affected Version To: 1.6.9
Patch Exists: Yes
Related CWE: None
CPE: a:mybb:mybb
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
Unknown

MyBB <1.6.9 is vulnerable to Stored, Error based, SQL Injection

It can be done by using Tamper Data(Or Live HTTP Headers), and when submitting a post, edit the 'posthash' POST parameter to your payload, submitting, then going to edit your post.

Mitigation:

Upgrade to the latest version of MyBB
Source

Exploit-DB raw data:

MyBB <1.6.9 is vulnerable to Stored, Error based, SQL Injection.

Vulnerable code:

/editpost.php

===
Line 398
===
$posthash_query = "posthash='{$posthash}' OR ";
===


It can be done by using Tamper Data(Or Live HTTP Headers), and when
submitting a post, edit the 'posthash' POST parameter to your payload,
submitting, then going to edit your post.


Small "HOWTO" in picture: http://imgur.com/a/JxfEI

This bug was not found by me, but afaik, I am the first one to release it.


-- 
*Joshua Rogers* - Retro Game Collector && IT Security Specialist
gpg pubkey <http://www.internot.info/docs/gpg_pubkey.asc.gpg>

Navigation

Suggest Exploit

Services By CQR