MyBulletinBoard Avatar URL HTML Injection Vulnerability
BID:19314
Info
MyBulletinBoard Avatar URL HTML Injection Vulnerability
| Bugtraq ID: | 19314 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 02 2006 12:00AM |
| Updated: | Aug 03 2006 08:01PM |
| Credit: | Aliaksandr Hartsuyeu is credited with the discovery of this vulnerability. |
| Vulnerable: |
MyBulletinBoard MyBulletinBoard 1.1.6 MyBulletinBoard MyBulletinBoard 1.1.5 MyBulletinBoard MyBulletinBoard 1.1.4 MyBulletinBoard MyBulletinBoard 1.1.3 MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBulletinBoard 1.1.1 MyBulletinBoard MyBulletinBoard 1.1 MyBulletinBoard MyBulletinBoard 1.0.4 MyBulletinBoard MyBulletinBoard 1.0.3 MyBulletinBoard MyBulletinBoard 1.0.2 MyBulletinBoard MyBulletinBoard 1.0.1 MyBulletinBoard MyBulletinBoard 1.0 PR2 MyBulletinBoard MyBulletinBoard 1.0 MyBulletinBoard MyBulletinBoard RC4 MyBulletinBoard MyBulletinBoard RC3 MyBulletinBoard MyBulletinBoard RC2 MyBulletinBoard MyBulletinBoard RC1 MyBulletinBoard MyBulletinBoard 1.2 MyBulletinBoard MyBulletinBoard 1.10 |
| Not Vulnerable: |
MyBulletinBoard MyBulletinBoard 1.1.7 |
Discussion
MyBulletinBoard Avatar URL HTML Injection Vulnerability
MyBulletinBoard (or MyBB) is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
MyBulletinBoard 1.1.6 and prior versions are vulnerable to this issue.
MyBulletinBoard (or MyBB) is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
MyBulletinBoard 1.1.6 and prior versions are vulnerable to this issue.
Exploit / POC
MyBulletinBoard Avatar URL HTML Injection Vulnerability
Attackers can exploit this issue via a web client.
The following proof of concept is available:
Javasc ript:alert(123) using the tab symbol to separate the 'script' portion of 'javascript'.
Attackers can exploit this issue via a web client.
The following proof of concept is available:
Javasc ript:alert(123) using the tab symbol to separate the 'script' portion of 'javascript'.
Solution / Fix
MyBulletinBoard Avatar URL HTML Injection Vulnerability
Solution:
The vendor has released version 1.1.7 to address this issue. Please refer to the references for more information.
Solution:
The vendor has released version 1.1.7 to address this issue. Please refer to the references for more information.
References
MyBulletinBoard Avatar URL HTML Injection Vulnerability
References:
References:
- MyBB Avatar URL XSS Vulnerability ([email protected])
- MyBulletinBoard Home Page (MyBulletinBoard)