MyBB Profile Albums Plugin 0.9 – ‘albums.php?album’ SQL Injection

• Exploit Database
• 172 阅读

• 作者： Zixem
  日期： 2012-10-16
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/22003/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

  # Exploit Title: Profile Albums MyBB plugin SQL Injection 0day # Google Dork: inurl:albums.php intext:"powered by Mybb" # Date: 14.10.2012 # Exploit Author: Zixem # Software Link: http://mods.mybb.com/view/profilealbums # Version: 0.9 # Tested on: Linux. ----------------------------------------------   The vulnerabillity exist within albums.php :   <? /*Line 69*/ $aid = $mybb->input[&apos;album&apos;]; /*Line 86*/ $query_add_breadcrumb = $db->simple_select("albums", "*", "aid=&apos;".$aid."&apos;"); ?>   /albums.php?action=editimage&image=[Vaild_ID]&album=[Vaild_album_ID][SQLi]   (You need to create a new account && upload album and images) ---------------------------------------------- Image : http://i.imgur.com/yeAx0.png     Follow: https://twitter.com/PonyBlaze