MyBB Bank v3 Plugin 'r_username' Parameter SQL Injection Vulnerability
28 Dec. 2012
Summary
The Bank v3 plugin for MyBB is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/bank.php/GET transactions=send/POST r_pay=Red_Hat&r_username=[SQLi]
