MyBB Bank v3 SQL Injection

2012-12-11T00:00:00
ID PACKETSTORM:118770
Type packetstorm
Reporter Red_Hat
Modified 2012-12-11T00:00:00

Description

                                        
                                            `# Exploit Title: Bank v3 MyBB plugin SQLi 0day  
# Exploit Author: Red_Hat [NullSec]  
# Software Link: http://mods.mybb.com/download/bank-v3  
# Tested on: Windows & Linux.  
  
Vulnerable code :  
  
<?php  
$user=$_POST['r_username'];  
$pay=intval($_POST['r_pay']);  
$query_r=$db->query("SELECT * FROM ".TABLE_PREFIX."users WHERE username='$user'");  
$fetch=$db->fetch_array($query_r);  
?>  
  
The variable '$mybb->input['id']' remains unsanitized.  
  
Usage :  
http://www.site.com/bank.php  
/GET transactions=send  
/POST r_pay=Red_Hat&r_username=[SQLi]  
  
Shoutout to Zixem <3 & NullSec :3  
  
`