MyBB 1.6.12 SQL Injection / PHP Warning (Minor)

MyBB 1.6.12 SQL Injection / PHP Warning (Minor)
Exploit :

search.php?action=results&sid[0]=9afaea732cb32f06fa34b1888bd237e2&sortby=&order=

Demo :

http://community.mybb.com/search.php?action=results&sid%5B0%5D=9afaea732cb32f06fa34b1888bd237e2&sortby=&order

Error :

Warning [2] mysqli_real_escape_string() expects parameter 2 to be string,
array given - Line: 874 - File: inc/db_mysqli.php PHP 5.4.19

------------------------------------------------------------------------------------

How To patch :

edit search.php and find this line :


$sid = $db->escape_string($mybb->input['sid']);


change this line to :


if(is_array($mybb->input['sid']))
$sid = $db->escape_string(implode($mybb->input['sid']));
else
$sid = $db->escape_string($mybb->input['sid']);

[b]Source: [url]http://packetstormsecurity.com/files/125375/MyBB-1.6.12-SQL-Injection.html[/b[/url]]