Local File Inclusion and reading password-protected forums in MyBB

Recently, I've been looking at the MyBB forum software to try to find security issues with it. Here are the results that I have so far. These have been reported privately to the maintainers of the software. The first two are fixed in version 1.8.15, and the third will be fixed in 1.8.16.

1. Local File Inclusion in admin panel.

From the admin panel, select:
Tools and Maintenance -> Task Manager -> Add New Task

Then, when submitting the request, modify the "file" POST parameter as shown below, and the file "../../../file.php" will be executed when the task is run (if the file exists).



2. Read posts in password-protected forums

A feature of MyBB is the ability to create password-protected forums. If a forum is password-protected, then only users who know the password will be able to view the posts in that forum.

However, MyBB does not require a password for users to subscribe to a password-protected forum (or the threads inside it). Furthermore, when users subscribe to a forum, they can get a notification by email or private message every time a user posts. This notification contains an excerpt of the message which was posted in the private forum.

To use, simply access the below URL while logged in as an ordinary user, then follow the prompts:
http://<target website>/usercp2.php?action=addsubscription&type=forum&fid=<forum id>&my_post_key=<your post key>

3. Forum passwords stored in plaintext

Unlike the passwords for users in MyBB (which are hashed), the passwords for password-protected forums are stored in plaintext. Although this is not directly exploitable, if someone gains access the database, they will be able to read the passwords.

Comments

  1. I really loved reading your blog. It was very well authored and easy to understand. Unlike other blogs I have read which are really not that good.Thanks alot
    jogos friv gratis
    Jogos online
    jogos 4 school

    ReplyDelete
  2. Planning a wedding that takes place under one roof, offers so many advantages. In the first instance a venue that offers a wedding package, tend to employ people who are experts in this field. They plan weddings for a living. They are the experts. Whilst many venues only offer the room and catering, a wedding under one roof many include a wedding planner and if they don't they will be working regularly with florists, cake makers, companies that do decorations, DJ's and photographers.
    Jogo para menino
    360 jogos 2019
    game io 2019

    ReplyDelete
  3. The cultural history of Inter-war Europe is filled with such powerful and influential interpretations of a reality that defeats the human capacity to imagine evil. Take Picasso's Guernica for instance. In June 1937, Picasso finished painting the Modernist classic in response to another April tragedy: the bombing of the Spanish city of Guernica during the civil war. It was his anguished creativity reacting to George Steer's eyewitness account of the incident.
    kizi kizi 2 games
    free games
    friv Games for kids 2019

    ReplyDelete
  4. Looking for best English to Tamil Translation tool online, make use of our site to enjoy Tamil typing and directly share on your social media handle. mallika manivannan novels

    ReplyDelete
  5. Thanks for sharing an informative blog keep rocking bring more details.I like the helpful info you provide in your articles. I’ll bookmark your weblog and check again here regularly. I am quite sure I will learn much new stuff right here! Good luck for the next!
    mobile application development training online
    mobile app development course
    mobile application development training
    mobile app development course online
    mobile application development course
    online mobile application development
    learn mobile application development

    ReplyDelete
  6. Aluminium Composite Panel or ACP Sheet is used for building exteriors, interior applications, and signage. They are durable, easy to maintain & cost-effective with different colour variants.

    ReplyDelete
  7. Soma pill is very effective as a painkiller that helps us to get effective relief from pain. This cannot cure pain. Yet when it is taken with proper rest, it can offer you effective relief from pain.
    This painkiller can offer you relief from any kind of pain. But Soma 350 mg is best in treating acute pain. Acute pain is a type of short-term pain which is sharp in nature. Buy Soma 350 mg online to get relief from your acute pain.

    https://globalonlinepills.com/product/soma-350-mg/


    Buy Soma 350 mg
    Soma Pill
    Buy Soma 350 mg online



    Buy Soma 350 mg online
    Soma Pill
    Buy Soma 350 mg

    ReplyDelete
  8. Good job! Fruitful article. I like this very much. It is very useful for my research. It shows your interest in this topic very well. I hope you will post some more information about the software. Please keep sharing!!
    SEO Training in Chennai
    SEO Training in Bangalore
    SEO Training in Coimbatore
    SEO Training in Madurai
    SEO Course in Chennai
    SEO Course in Chennai
    SEO Course in Bangalore
    SEO Course in Coimbatore

    ReplyDelete
  9. Great Article. Thank you for sharing! Really an awesome post for every one.

    IEEE Final Year projects Project Centers in Chennai are consistently sought after. Final Year Students Projects take a shot at them to improve their aptitudes, while specialists like the enjoyment in interfering with innovation. For experts, it's an alternate ball game through and through. Smaller than expected IEEE Final Year project centers ground for all fragments of CSE & IT engineers hoping to assemble. Final Year Project Domains for IT It gives you tips and rules that is progressively critical to consider while choosing any final year project point.

    Spring Framework has already made serious inroads as an integrated technology stack for building user-facing applications. Spring Framework Corporate TRaining the authors explore the idea of using Java in Big Data platforms.
    Specifically, Spring Framework provides various tasks are geared around preparing data for further analysis and visualization. Spring Training in Chennai

    ReplyDelete

Post a Comment

Popular posts from this blog

Experimenting with the Audiocodes MP264

Security implications of ANSI escape codes in Git sever responses