Multiple stored XSS-vulnerabilities in MyBB v. 1.8.3

[Steffen Rösemann <steffen.roesemann1986 () gmail com>]

Advisory: Stored XSS-Vulnerabilities in MyBB v. 1.8.3
Advisory ID: SROEADV-2015-15
Author: Steffen Rösemann
Affected Software: MyBB v. 1.8.3
Vendor URL: http://www.mybb.com
Vendor Status: patched
CVE-ID: -

==========================
Vulnerability Description:
==========================

MyBB v. 1.8.3 suffers from multiple stored XSS-vulnerabilities in the
administrative backend.

==================
Technical Details:
==================

The stored XSS-vulnerabilities can be found in different modules in the
following locations of a common MyBB installation:

======================
Module "config-attachment_types"
======================

via form-field MIME-type:

http://{TARGET}/admin/index.php?module=config-attachment_types&action=add

executed in: e.g. http://
{TARGET}/admin/index.php?module=config-attachment_types

===============
Module "config-mycode"
===============

via form fields "title" and "short description":

http://{TARGET}/admin/index.php?module=config-mycode&action=add

executed in: e.g. http://{TARGET}/admin/index.php?module=config-mycode

===================
Module "forum-management"
===================

via form field "title":

http://{TARGET}/admin/index.php?module=forum-management&action=add

executed in: e.g. http://{TARGET}/admin/index.php?module=forum

==============
Module "user-groups"
==============

via form fields "title" and/or "short description":

http://{TARGET}/admin/index.php?module=user-groups&action=add

executed in: e.g. http://{TARGET}/admin/index.php?module=user-groups

================
Module "style-templates"
================

via form field "name":

http://{TARGET}/admin/index.php?module=style-templates&action=add_set

executed in: e.g. http://{TARGET}/admin/index.php?module=style-templates

====================================
Module "style-templates" in action "add_template_group"
====================================

via form field "title":

http://
{TARGET}/admin/index.php?module=style-templates&action=add_template_group

executed in: e.g. http://
{TARGET}/admin/index.php?module=style-templates&sid={TEMPLATES_NUMERIC_ID}

=============
Module "tool-tasks"
=============

via form field "title":

http://{TARGET}/admin/index.php?module=tools-tasks&action=add

executed in: e.g. http://{TARGET}/admin/index.php?module=tools-adminlog

=================
Module "config-post_icons"
=================

via form field "name":

http://{TARGET}/admin/index.php?module=config-post_icons&action=add

executed in: e.g. http://{TARGET}/admin/index.php?module=tools-adminlog

=============
Module "user-titles"
=============

via form field "title to assign":

http://{TARGET}/admin/index.php?module=user-titles&action=add

executed in: e.g. http://{TARGET}/admin/index.php?module=tools-adminlog

================
Module "config-banning"
================

via form field "username":

http://{TARGET}/admin/index.php?module=config-banning&type=usernames

executed in: e.g. http://{TARGET}/admin/index.php?module=tools-adminlog

=========
Solution:
=========

Upgrade to v. 1.8.4.


====================
Disclosure Timeline:
====================
02/03-Feb-2015 – found the vulnerabilities
03-Feb-2015 - informed the developers according to their security issue
rules (see [3])
03-Feb-2015 – release date of this security advisory [without technical
details]
03-Feb-2015 - vendor replied, issues will be patched
15-Feb-2015 - vendor released patch v. 1.8.4 (see [4])
19-Feb-2015 - release date of this security advisory
19-Feb-2015 - send to FullDisclosure

========
Credits:
========

Vulnerability found and advisory written by Steffen Rösemann.

===========
References:
===========

[1] http://www.mybb.com
[2] http://sroesemann.blogspot.de/2015/02/sroeadv-2015-15.html
[3] http://www.mybb.com/get-involved/security/
[4]
http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/