mybb v1.1.1(rss.php) SQL Injection Exploit May 18 2006 03:35PM
Breeeeh hotmail com
----------------------------------

Foud By: Breeeeh & CrAzY CrAcKeR

Site: www.alshmokh.com

Email:Breeeeh (at) hotmail (dot) com [email concealed]

----------------------------------

$query = $db->query("SELECT * FROM ".TABLE_PREFIX."forums f WHERE 1=1 $forumlist");

$comma = " - ";

while($forum = $db->fetch_array($query))

{

$title .= $comma.$forum['name'];

$forumcache[$forum['fid']] = $forum;

$comma = ", ";

----------------------------------

Example:

/rss.php?...$comma=[SQL]

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus