MyBB 1.6.9 - 'editpost.php?posthash' Blind SQL Injection

Author: Joshua Rogers
type: webapps
platform: php
port: 
date_added: 2012-12-31 
date_updated: 2017-11-06 
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.commybb_1608.zip

MyBB <1.6.9 is vulnerable to Stored, Error based, SQL Injection.

Vulnerable code:

/editpost.php

===
Line 398
===
$posthash_query = "posthash='{$posthash}' OR ";
===


It can be done by using Tamper Data(Or Live HTTP Headers), and when
submitting a post, edit the 'posthash' POST parameter to your payload,
submitting, then going to edit your post.


Small "HOWTO" in picture: http://imgur.com/a/JxfEI

This bug was not found by me, but afaik, I am the first one to release it.


--
*Joshua Rogers* - Retro Game Collector && IT Security Specialist
gpg pubkey <http://www.internot.info/docs/gpg_pubkey.asc.gpg>