Sql Injection Vulnerability Found by Security Researcher in MyBB [tamperdata,test,examples]

 

First of Fall what is sql injection ?

SQL mixture is a kind of security try in which the attacker incorporates Structured Query Language (SQL) code to a Web structure information box to get access to resources or take off changes to data. There are many sql injection tutorial in Internet as well sql injection examples.A SQL request is a requesting for some movement to be performed on a database. Regularly, on a Web structure for customer check, when a customer enters their name and mystery key into the substance boxes suited them, those qualities are implanted into a SELECT inquiry. In case the qualities entered are found of course, the customer is allowed access; if they aren't found, access is denied. Regardless, most Web structures have no instruments set up to square incorporate other than names and passwords. Unless such preliminary measures are taken, an assailant can use the information boxes to send their speak to the database, which could allow them to download the entire database or interface with it in other unlawful ways. 

 
Sql injection cheat sheet  :

If you want to learn Advance Sql Injection so click here of cheat sheet.

Mybb 1.8.x SQL Injection Vulnerability POC by MakMan:

Title:
MyBB 1.8.X to 1.8.1 Error based SQL Injection

Exploit URL and POC :
http://pastie.org/private/qqgmvkyn758abfiyutje3q

Date : 2014-11-15
Google Dork : intext:Powered By MyBB # Version: 1.8.X
# Tested on: Linux / Python 2.7
# Status : Patched in MyBB 1.8.2
# Author : MakMan -- facebook.com/hackticlabs

   

Here is the POC Video For the SQL Injection Vulnerability :

Mybb 1.8.x SQL Injection POC by MakMan from Mukarram Khalid on Vimeo.


IF you want any Question about this vulnerability or anything Please Feel Free to Comment Below .