[0DAY] BitBreach.org MyBB SQLi Vuln

[Aldes]

Yo, skids and elites, got a fresh 0day for ya. Found a nasty SQL injection in

You do not have permission to view the link please Log in or Register

MyBB login page (v1.8.x). No patch, no CVE, pure chaos. I’m dropping this here cuz their admin’s asleep, and I’m feeling generous. DB’s wide open.

Steps to Pwn:

1. Hit
   You do not have permission to view the link please Log in or Register
   with a crafted POST request to the login form.
2. Inject payload in username field: admin' OR 1=1; -- (tweak it, you know the drill).
3. Snag session cookies, escalate to admin panel. Tables mybb_users and mybb_sessions are juicy.
4. Use the Python tool below to test or dump DB. Hashes crack easy (MD5, no salt).

Python Tool (save as bitbreach_sqli.py, run with python bitbreach_sqli.py)

Run: python bitbreach_sqli.py -t

You do not have permission to view the link please Log in or Register

-p "admin' OR 1=1; --"

 

[olanprimotivo]

This is great a new lea

 

[Yerardo]

BRO, THIS LEAK IS REALLY USEFULL

 

[shad0waN0nXX]

thanks going test it

 

[VECNA]

Ggs Man