MyBB 'Recent Topics on Index page' Plugin 'Title' Field HTML Injection Vulnerability

Bugtraq ID:	46534
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 23 2011 12:00AM
Updated:	Feb 23 2011 12:00AM
Credit:	Xinapse
Vulnerable:	MyBB Recent Topics on Index page Plugin 0
Not Vulnerable:

MyBB 'Recent Topics on Index page' Plugin 'Title' Field HTML Injection Vulnerability

The 'Recent Topics on Index page' plugin for MyBB is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

MyBB 'Recent Topics on Index page' Plugin 'Title' Field HTML Injection Vulnerability

Attackers can exploit this issue through a browser.

MyBB 'Recent Topics on Index page' Plugin 'Title' Field HTML Injection Vulnerability

Solution:
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at:[email protected].

MyBB 'Recent Topics on Index page' Plugin 'Title' Field HTML Injection Vulnerability

References:

• MyBB Recent Topics on Index page Plugin (MyBB)