MyBB Hide Thread Content Plugin 1.0 – Information Disclosure

• Exploit Database
• 13 阅读

• 作者： 0xB9
  日期： 2021-01-29
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49496/

• # Exploit Title: MyBB Hide Thread Content Plugin 1.0 - Information Disclosure
  # Date: 1/27/2021
  # Author: 0xB9
  # Twitter: @0xB9Sec
  # Contact: 0xB9[at]pm.me
  # Software Link: https://community.mybb.com/mods.php?action=view&pid=1430
  # Version: 1.0
  # Tested on: Windows 10
  # CVE: CVE-2021-3337
  
  1. Description:
  This plugin hides thread content until user replies to the thread. The information disclosure is hidden content can be viewed without replying.
  
  2. Proof of Concept:
  
  - Visit a post where content is hidden
  - Click the reply or quote button below
  Thread content will be displayed in the [quote] bracket without needing to reply