Advertisement


Looking for a fix? Check your Codebase security with multiple scanners from Scanmycode.today


Edit Report

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2018090206

Below is a copy:

MyBB Visual Editor Stored XSS <= v1.8.18
[+] Title: MyBB Visual Editor Stored XSS <= v1.8.18
[+] Author: Numan OZDEMIR
[+] Vendor Homepage: mybb.com
[+] Software Link: https://mybb.com/download/
[+] Version: Up to v1.8.18. Fixed in v1.8.19.
[+] PoC Video: https://numanozdemir.com/mybb/xss.mp4
[+] CVE: CVE-2018-17128
[+] Discovered by Numan OZDEMIR in InfinitumIT Labs
[+] [email protected] - [email protected]
 
[~] Description:
 
Attacker can run JavaScript codes in victim user's browser while victim is replying a post.
'videotype' section causes this.

[~] How to Reproduce:

1)- Enter to thread posting page. (newthread.php, enter title and content.)
2)- Click "insert a video" command. Select any source and insert any URL.
3)- Edit the video source with your payload.
Or, directly add this code:
[video=PAYLOAD]xxx[/video]
Example:
[video=PA<svg/onload=alert('xss')>YLOAD]xxx[/video]

4)- Post the thread.

While victim user replying your post, his browser will run JavaScript.
Vulnerable pages:
editpost.php
newreply.php
private.php
and all Visual Editor embedded pages.

// for secure days...

Copyright ©2020 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.