https://diaryofinjector.com/tags/mybb/Recent content in Mybb on diaryofinjectorHugoenMon, 10 Nov 2014 00:00:00 +0000https://diaryofinjector.com/posts/mybb-chatbox-xss/Mon, 10 Nov 2014 00:00:00 +0000https://diaryofinjector.com/posts/mybb-chatbox-xss/<p><strong>Versions Affected</strong>: I.D.K.(never tested but works on the latest one)</p> <p><strong>Vulnerable file:</strong></p> <p>&ldquo;<strong>chatbox/message.php</strong>&rdquo;</p> <p>on lines</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-php" data-lang="php"><span class="line"><span class="cl"><span class="mi">54</span><span class="o">:</span> <span class="nv">$shout</span><span class="p">[</span><span class="s1">&#39;color&#39;</span><span class="p">]</span> <span class="o">=</span> <span class="nx">strip_tags</span><span class="p">(</span><span class="nv">$shout</span><span class="p">[</span><span class="s1">&#39;color&#39;</span><span class="p">]);</span> </span></span><span class="line"><span class="cl"><span class="mi">55</span><span class="o">:</span> <span class="nv">$shout</span><span class="p">[</span><span class="s1">&#39;font&#39;</span><span class="p">]</span> <span class="o">=</span> <span class="nx">strip_tags</span><span class="p">(</span><span class="nv">$shout</span><span class="p">[</span><span class="s1">&#39;font&#39;</span><span class="p">]);</span> </span></span></code></pre></div><p>U shall use <code>htmlspecialchars($shout['color'],ENT_QUOTES);</code> or similar instead of <strong>strip_tags()</strong>. Strip_tags just blocks html tags, doesnt do anything for quotation marks. That is why it was named <strong>&ldquo;strip_tags&rdquo;</strong> ;)</p> <p><strong>Tested on madleets.com;</strong></p> <p><strong>Sorry guys dont take it personal ;)</strong></p> <p><strong>Example attack:</strong> Send a message on chatbox with editing selected font value like this(you can use inspect element options on browsers):</p>