MyBB KingChat Plugin – SQL Injection

# Exploit Title: KingChat MyBB plugin SQL Injection 0day

# Google Dork: inurl:"kingchat.php"

# Date: 13.10.2012

# Exploit Author: Red_Hat [NullSec]

# Software Link: http://mods.mybb.com/view/kingchat

# Tested on: Windows & Linux.

Vulnerable code :

<?php

$username=$_GET['username'];

$uid=$_GET['uid'];

$text=$_GET['text'];

$users=$db->query("SELECT * FROM ".TABLE_PREFIX."users WHERE username='$username'");

$users_info=$db->fetch_array($users);

$users_num=$db->num_rows($users);

$fusername=$users_info['uid'];

The variable '$username' remains unsanitized.

Usage : http://www.site.com/kingchat.php?send=Red_Hat&username=[SQLi]

Shoutout to Zixem <3 & NullSec :3