[41885] in bugtraq
MyBB 1.0 SQL injection in uploading file
daemon@ATHENA.MIT.EDU (addmimistrator@gmail.com)
Sat Dec 31 12:20:15 2005
Date: 31 Dec 2005 09:55:51 -0000
Message-ID: <20051231095551.20397.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: addmimistrator@gmail.com
To: bugtraq@securityfocus.com
Hey
there is a security bug in inc/function_upload.php script in mybb all version (except two days ago security updated version) that allows SQL INJECTION
this bug is in function of upload attachment .
when a file goes to upload this function test that if file has a valid extension . for this call getextension function and fetch all of characters after last period sign. then make a query and search in valid extensions table and here a file with quoted extension include sql statement will be execute.
this bug reported to mybb offical site and patched as a security patch in internal version 1.0.1 two days ago
be beauty
imei
