MyBB Xbox Live ID Cross Site Scripting

2012.12.19
Credit: limb0
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

# Exploit Title: Xbox Live ID MyBB Plugin Stored XSS # Date: 13/12/2012 # Exploit Author: limb0 # Vendor Homepage: http://www.leveleando.com # Software Link: http://mods.mybb.com/view/profile-xbox-live-id # Version: 1.0 # Category:Web Security # Tested on: Linux +------------------------------------------------------------+ Stored XSS-Instructions 1.Install&Activate plugin (Maybe you will get an error: About a "/" on line 31. Open your plugin file and delete the slash.The coder didn't notice that) 2.Go to UserCP >> Edit Profile >> Xbox Live ID 3.Inject your string(xss) ex. "><script>alert(1)</script> 4.Visit your profile and voila Proof Inject:http://postimage.org/image/hpxk33od3/ Result:postimage.org/image/6vzb5sqgd/ +-------------------------------------------------------------+ Vulnerable code: function profilexli_update($xli) { global $mybb; if (isset($mybb->input['xli'])) { $xli->user_update_data['xli'] = $mybb->input['xli']; } }

References:

http://www.leveleando.com
http://mods.mybb.com/view/profile-xbox-live-id


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top