|
|
| |
| MyBB AwayList Plugin (index.php, id parameter) suffers from SQL injection vulnerability |
| |
Credit:
The information has been provided by Red_Hat.
|
| |
Vulnerable Systems:
* MyBB AwayList Plugin
Vulnerable code :
<?php
$query = $db->simple_select( // 245
"awaylist", '*', "id = '" . $mybb->input['id'] . "'" // 246
); // 247
$item = $db->fetch_array($query); // 248
?>
The variable '$mybb->input['id']' remains unsanitized.
Usage : http://server/index.php?action=editAwlItem&id=[SQLi]
Exploit-DB Not:
This is what worked for us: awaylist.php?action=editAwlItem&id=1'
Disclosure Timeline:
Published: 2012-12-24
|
|
blog comments powered by
|
