How to Fix MyBB 1.6.12/1.6.13 SQL Injection

[TheDerpKing]

Vulnerability - "search.php?action=results&sid[0]=9afaea732cb32f06fa34b1888bd237e2&sortby=&order="

Edit search.php and find this line :
$sid = $db->escape_string($mybb->input['sid']);


Change this Line to:
if(is_array($mybb->input['sid']))
$sid = $db->escape_string(implode($mybb->input['sid']));
else
$sid = $db->escape_string($mybb->input['sid']);

Note: I don't Take Credit for Finding or Patching this.
​

 

[Zahreah]

Yo Tox, look @dis

 

[Toxique]

Yo Tox, look @dis

We are using Mybb version 1.6.14, this issue does not affect us

 

[Zahreah]

I knew that.