Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
[F] Duplicate user-names (a race condition?)
#1
MyBB 1.2
I have found in my DB users with same usernames and consecutive UID-s (e.g. 17000 and 17001; same e-mails etc.). I do not know how they were created (accounts were registered by forum), but it can be a race condition (check if user exist and then insert user).

A simple solution is a UNIQUE INDEX for username column in mybb_users.

MyBB 1.2 does not have any index on username, MyBB 1.4 have only "INDEX".

UNIQUE INDEX also solves "MySQL and SQL Column Truncation Vulnerabilities" (although MyBB seems to be invulnerable for this because of removing multiple spaces from username in datahandler\user.php).
www.kozik.net.pl
- So... Maybe you shouldn't have hacked it.
- And why don't you try not breathing. Hurts, dunnit. (userfriendly.org)


Messages In This Thread
[F] Duplicate user-names (a race condition?) - by koziolek - 2008-09-12, 07:53 AM

Forum Jump:


Users browsing this thread: 1 Guest(s)