MyBB Profile Wii Friend Code SQLi/Persistent XSS

vendor:

Profile Wii Friend Code

by:

Ichi

7,5

CVSS

HIGH

SQL UPDATE Injection and Persistent XSS

89, 79

CWE

Product Name: Profile Wii Friend Code

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 64-bit

2013

MyBB Profile Wii Friend Code SQLi/Persistent XSS

The vulnerable code lies in profilewfc.php, where the input is not sanitized. To exploit the Persistent XSS, the user must go to their user cp and edit their profile, entering a malicious script into the 'Wii Friend Code' box. To exploit the SQL Injection, the user must enter 'x', usergroup='4' into the 'Wii Friend Code' box. This will allow the user to belong to whatever usergroup they choose.

Mitigation:

Sanitize user input

Source

Exploit-DB raw data:

# Exploit Title: MyBB Profile Wii Friend Code SQLi/Persistent XSS
# Dork: intitle:"Profile of" intext:"Wii Friend Code" inurl:member.php
# Date: 1/3/2013
# Exploit Author: Ichi
# Vendor Homepage: http://mods.mybb.com/view/profile-wii-friend-code
# Software Link: http://mods.mybb.com/download/profile-wii-friend-code
# Version: 1.0
# Tested on: Windows 7 64-bit

"Profile Wii Friend Code" MyBB plugin is vulnerable to SQL UPDATE Injection and Persistent XSS.

The vulnerable code lies here(in profilewfc.php):

<?php
function profilewfc_update($wfc)
{
  global $mybb;

  if (isset($mybb->input['wfc']))
   {
      $wfc->user_update_data['wfc'] = $mybb->input['wfc'];
   }
}
?>

As you can see the input is not sanitized in the least...

Persistent XSS:
1. Go to your user cp and edit your profile - usercp.php?action=profile
2. and at the "Wii Friend Code Wii Friend Code" box enter: <script>alert(1)</script> and then press submit
3. http://prntscr.com/o1x2p, submit, and http://prntscr.com/o1x69

SQL Injection:
1. Go to your user cp and edit your profile - usercp.php?action=profile
2. Enter this into the Wii Friend Code field as you would do with the 1st vulnerability: x', usergroup='4
3. submit and now you belong to whatever usergroup to choice to belong to

PoC:
Before: http://prntscr.com/o1xkg
Exploit: http://prntscr.com/o1xnd
Aftermath(now an admin): http://prntscr.com/o1xoj

https://twitter.com/TeamDigi7al
~Ichi