Vulnerable Systems:
* MyBB Profile Skype ID Plugin 1.0
ProfileSkypeID plugin suffers from SQL Injection in UPDATE query. The vulnerabillity exist within profileskype.php which located in /inc/plugins/ folder.
function profileskype_update($skype) /*Line 167*/
{
global $mybb;
if (isset($mybb->input['skype']))
{
$skype->user_update_data['skype'] = $mybb->input['skype'];
}
}
?>
How to exploit:
(1) Go to usercp.php?action=profile
(2) Insert this following string in your Skype ID: zix', usergroup='4
(3) Have some fun, you're an admin.
Proof of concept:
(1) Writing the injection: http://i.imgur.com/hg3FW.png
(2) Updates the profile and waiting a few seconds: http://i.imgur.com/fkwdi.png
(3) You're an admin: http://i.imgur.com/JIkRX.png
