MyBB 1.6 Cross Site Scripting

`============================================  
MyBB 1.6 <= Cross Site Scripting (XSS) Vulnerability  
============================================  
  
  
1. OVERVIEW  
  
MyBB was vulnerable to Cross Site Scripting Vulnerability.  
  
  
2. APPLICATION DESCRIPTION  
  
MyBB is a free bulletin board system software package developed by the  
MyBB Group.  
It's supposed to be developed from XMB and DevBB bulletin board applications.  
  
  
3. VULNERABILITY DESCRIPTION  
  
Two XSS vulnerabilities were found. One is user-driven XSS on "url" parameter.  
User will get xssed upon successful log-in.  
The other is a reflected XSS on "posthash" parameter where the valid  
tid (topic id) is required for successful attack.  
The anti-CSRF check against "my_post_key" parameter was not done in  
thread/post preview mode and thus there came a way for XSS to be  
successful.  
  
  
4. VERSIONS AFFECTED  
  
MyBB 1.6 and lower  
  
  
5. PROOF-OF-CONCEPT/EXPLOIT  
  
User-driven XSS  
http://attacker.in/mybb/member.php?action=login&url=javascript:alert%28/XSS/%29  
  
Reflected XSS  
http://attacker.in/mybb/newreply.php?my_post_key=&subject=XSS&action=do_newreply&posthash="><script>alert(/XSS/)</script>&quoted_ids=&lastpid=1&from_page=1&tid=1&method=quickreply&message=test&previewpost=Preview  
Post  
  
  
6. SOLUTION  
  
Upgrade to 1.6.1  
  
  
7. VENDOR  
  
MyBB Development Team  
http://www.mybb.com/  
  
  
8. CREDIT  
  
This vulnerability was discovered by Aung Khant, http://yehg.net, YGN  
Ethical Hacker Group, Myanmar.  
  
  
9. DISCLOSURE TIME-LINE  
  
2010-12-09: notified vendor  
2010-12-15: vendor released fixed version  
2010-12-20: vulnerability disclosed  
  
  
10. REFERENCES  
  
Original Advisory URL:  
http://yehg.net/lab/pr0js/advisories/[mybb1.6]_cross_site_scripting  
About MyBB: http://www.mybb.com/about/mybb  
  
  
#yehg [2010-12-20]  
  
---------------------------------  
Best regards,  
YGN Ethical Hacker Group  
Yangon, Myanmar  
http://yehg.net  
Our Lab | http://yehg.net/lab  
Our Directory | http://yehg.net/hwd  
`