MYBB VERSION 1.1 XSS BUG ASS !TESTED!

[mesvak 362]

[hide]

 

 

# Exploit Title: MyBB Latest Posts on Profile Plugin v1.1 - Cross-Site Scripting
# Date: 4/20/2018
# Author: Mesvak
# Version: 1.1
# Tested on: Ubuntu 17.10


1. Description:
Adds a new section to user profiles that will display their last posts.


2. Proof of Concept:

Persistent XSS
- Create a thread with the following subject 
- Now visit your profile to see the alert.

 

 

 

 

 

[/hide]

 

 

SOLUTION

[hide]

 

 

 

$d['tsubject'] = htmlspecialchars_uni($d['tsubject']);

 

 

 

 

 

[/hide]

Now fuck off XD Dont forget to lib a like all creds goes to mesvak cz i m the on who is leeching them XD     

[Ahmad786 8]

thnx man good job

[looplife55 2]

Thanks dude for helping noob

[lucirms 0]

thnaks dude let me see