MyBB 1.8.13 – Cross-Site Scripting - 体验盒子

作者： Pabstersac

日期： 2017-11-11

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/43137/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

# Exploit Title: XSS in MyBB up to 1.8.13 via installer

# Date: Found on 05-29-2017

# Exploit Author: Pablo Sacristan

# Vendor Homepage: https://mybb.com/

# Version: Version > 1.8.13 (Fixed in 1.8.13)

# CVE : CVE-2017-16781

No HTML escaping when returning an $error in /install/index.php can

lead to an XSS which can be used to take over an attacker account.

The vulnerability occurs in /install/index.php:2503 and occurs because

there is no html encoding of the $error. A simple way to exploit this

is to create an error by using the Database Server Hostname and

inserting HTML characters there.

It is a POST XSS and this is a PoC:

</form>

Using this attack you can steal the cookies and you can install the MyBB server as you want, giving you almost full control over the MyBB server.

A simple fix would be to change the function error_list($array) to:

function error_list($array)

{

$string = "<ul>\n";

foreach($array as $error)

{

$string .= "<li>";

$string .= htmlspecialchars($error);

$string .= "</li>";

}

$string .= "</ul>\n";

return $string;

}