MyBBRC4.txt

`SQL Injection Vulnerabilities in MyBB RC 4 (+Security Patch)  
  
Vendor: MyBB Group  
Version: MyBulletinBoard 1.00 RC4+ Security Patch  
Risk: High if magic_quotes_gpc = Off  
URL: http://www.mybboard.com  
  
**********************************************************************************************  
  
"MyBB is a powerful, efficient and free forum package developed in PHP and  
  
MySQL. MyBB has been designed with the end users in mind, you and your  
  
subscribers. Full control over your discussion system is presented right at  
  
the tip of your fingers, from multiple styles and themes to the ultimate  
  
customisation of your forums using the template system."  
  
  
*********************************************************************************************  
  
There is one high risk SQL Injection vulnerabilities in MyBB, but to  
exploit this issue magic_quotes_gpc must be off.  
  
SQL Injection in /admin/index.php  
  
POC: Username: ' or 1=1 /*  
Password: blank  
  
This issue gives you access to the Admin Control Panel and you are  
logged in as the Main Administrator  
  
**********************************************************************************************  
  
More SQL Injections (magic_quotes_gpc=off):  
  
member.php?action=login : username='[SQL INJECTION]  
polls.php?action=newpoll&tid=1&polloptions='[SQL INJECTION]  
search.php?action='[SQL Injection]  
member.php?action='[SQL Injection]  
.....  
....  
.......... (Many Many More...)  
  
  
*********************************************************************************************  
  
  
Solution:  
The developers were contacted and never responded.  
No patch is available.  
Turn magic_quotes_gpc ON or do not use this Application  
  
  
  
  
Phuket  
  
  
`