[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    MyBB 1.0 SQL injection in uploading file
From:       addmimistrator () gmail ! com
Date:       2005-12-31 9:55:51
Message-ID: 20051231095551.20397.qmail () securityfocus ! com
[Download RAW message or body]

Hey
there is a security bug in inc/function_upload.php script in mybb all version (except \
two days ago security updated version) that allows SQL INJECTION this bug is in \
function of upload attachment . when a file goes to upload this function test that if \
file has a valid extension . for this call getextension  function and fetch all of \
characters after last period sign. then make a query and search in valid extensions \
table and here a file with quoted extension include sql statement will be execute. \
this bug reported to mybb offical site and patched as a security patch in internal \
version 1.0.1 two days ago be beauty
imei


[prev in list] [next in list] [prev in thread] [next in thread]