Sign in to follow this  
mesvak

MYBB VERSION 1.3 MANY SITES USE THIS SHIT EVEN THE POPULAR ONES !!TESTED!!

Recommended Posts

[hide]

 

 

# Exploit Title: MyBB Threads to Link Plugin v1.3 - Persistent XSS
# Date: 3/15/2018
# Author: 0xB9
# Version: v1.3
# Tested on: Ubuntu 17.10


1. Description:
When editing a thread the user is given to the option to convert the thread to a link.


2. Proof of Concept:

Persistent XSS
- Edit a thread or post you've made
- At the bottom of the edit page in the Thread Link box input the following ">
- Now visit the forum your thread/post exists in to see the alert.

 

 

 

 

[/hide]

 

 

SOLUTION

 

[hide]

 

 

 

 

Patch in line 83:
$thread['tlink'] = ($thread['tlink']);

to

$thread['tlink'] = htmlspecialchars_uni($thread['tlink']);
           

 

 

[/hide]

 

 

 

Now fuck off XD Dont forget to lib like all creds goes to mesvak cz i m the on who is leeching them XD  kek.png kek.png hype.png hype.png

Share this post


Link to post
Share on other sites

MYBB VERSION 1.3 MANY SITES USE THIS SHIT EVEN THE POPULAR ONES !!TESTED!!

Share this post


Link to post
Share on other sites

cant wait to check this out

Share this post


Link to post
Share on other sites

good job dude thx u

  • Like 1

Share this post


Link to post
Share on other sites

WOOOOOOOOOOOOW THANKSS BROOOO VERY MUCH??????

Share this post


Link to post
Share on other sites

 

 

 

 

Ahora la mierda XD  No te  olvides de lib  una  como  todos los creds  va  a mesvak cz i  soy el  de  que los está descargando XD     kek.png kek.png hype.png hype.png

 

Is incredible your work men

Share this post


Link to post
Share on other sites

dgda gdaga sdga gdgadgaga

Share this post


Link to post
Share on other sites

:fyou: :fyou: :fyou: :fyou: :fuck: :fuck:

  • Like 1

Share this post


Link to post
Share on other sites

 

 

 

 

Now fuck off XD Dont forget to lib like all creds goes to mesvak cz i m the on who is leeching them XD  kek.png kek.png hype.png hype.png

 

thx manhood work :monkas:

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this