MyBB Community Forums

Hello, i want to connect my server login with mybb but it keep says invalid password.
Is there something wrong in the decrypt section ?






this is what i have :

<?php

$host = "Host";
$user = "Username";
$pass = "Password";
$name = "Database Name";
$_GET['name'] = str_replace("_"," ",$_GET['name']);
if($_GET['crypt'] != 4556879){
	echo '-1';
	exit;
}
if(!@mysql_connect($host, $user, $pass))  {
	die("error connecting to mysql server - " . mysql_error());	
}
if(!@mysql_select_db($name))  {
	die("error selecting mysql database - " . mysql_error());	
}

$query = mysql_query("SELECT * FROM mybb_users WHERE username = '".$_GET['name']."'");
if($row = mysql_fetch_array($query)){

$pass2 = md5(md5($row["salt"]).md5($_GET['pass']));
if($pass2 == $row["password"])
	echo ''.(2+$row["usergroupid"]);
else
	echo '1';
} else
echo '0';
?>

Don't decrypt, just encrypt the password or use what MyBB uses in your site.

1. usergroupid field doesn't exist in mybb_users table (unless it's your custom field).
2. Your query is vulnerable to SQL injections.
3. Why is this code used?

$_GET['name'] = str_replace("_"," ",$_GET['name']);

4. I don't see any "invalid password" error in the posted code. It's harder to tell what's wrong if you post only parts of it - I don't see anything wrong except 1. 2. and 3. in this excerpt.