MYBB 1.8.13 XSS BUG TESTED WITH PROOF

[mesvak 352]

[hide]

 

Exploit Title: XSS in MyBB up to 1.8.13 via installer
# Date: Found on 05-29-2017
# Exploit Author: Mesvak
# Version: Version > 1.8.13

No HTML escaping when returning an $error in /install/index.php can
lead to an XSS which can be used to take over an attacker account.

The vulnerability occurs in /install/index.php:2503 and occurs because
there is no html encoding of the $error. A simple way to exploit this
is to create an error by using the Database Server Hostname and
inserting HTML characters there.

It is a POST XSS and this is a PoC:
















Using this attack you can steal the cookies and you can install the MyBB server as you want, giving you almost full control over the MyBB server.

A simple fix would be to change the function error_list($array) to:
function error_list($array)
{
$string = "</pre>
<ul>\n";
foreach($array as $error)
{
           $string .= "";
           $string .= htmlspecialchars($error);
           $string .= "";
}
$string .= "</ul>\n";<br>return $string

 

 

 

 

 

[/hide]

WELP as far as ik they  already fixed this 

 

Now fuck off XD Dont forget to lib a like all creds goes to mesvak cz i m the on who is leeching them XD     

[Am1nol 254]

Nice :fappa: exploiting a xss in the installer :fappa:

 

 

Also please explain how this can be used to take over an account?

 

One of the most retarded impact descriptions there is :am1nol:

[mesvak 352]

PLS READ WATEVER INSIDE THE CODE SECTION

 

''No HTML escaping when returning an $error in /install/index.php can

lead to an XSS which can be used to take over an attacker account.''

 

 

and THE SHITTY THING IS Y OU CAN EVEN INSTALL WATEVER MYBB VERSION U WANT AND EVEN CREATE HOST AND BE ABLE TO TAKE THE DB ON THAT SHIT PLS READ THAN TALK :kappa:

[Ahmad786 9]

This looks interesting, thank you for sharing Heart

[Ahmad786 9]

Grey-hat hackers we are specialize in hacking services stated below and more please come with your hacking project for only serious mind. no free jobs

 

hack fb,twitter accounts and paypal

1.)take control of pc of victim without him knowing

2.)the same with the phone

3.)create virus trojan for work and hide,bind,crypt it in any file (undetectable)

4.)spy on pc and android phone

5.)hack fb,twitter accounts and paypal

6.)website attacks to steal database's

7.) [whatsapp hacker] [snapchat hacker]

8.)Clients based Customization and clearn criminal records from all site

9.)Hacking Iphone ss| SSN | Android based | ip |

spying

10). i will teach you about Bank Hacking Credit Card Hacking in Details

11)Contact me for Western Uninon Transfer Dumps Fullz Bank Logins Paypals

? Credit Cards Loading (Only USA & UK & CANADA "CC's)

 

No time wasters am here for real business

Contact Detail:

whatsapp : +1 682 302 5207

Discord ID: holyhck#1248

[mantu 0]

ssssssssssss

[bygermen 0]

elllerine saglık denıcem tahnx yhou

[saeedha3cker 4]

Thanks Johmyu Jhan

[BOUBOULE 1]

Also please explain how this can be used to take over an account?