PT-2019-9050 · Mybb · Ban List Plugin

0Xb9 · Publicado 2019-03-18 · Atualizado 2019-03-26 · CVE-2018-14724

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ban List plugin version 1.0 for MyBB

Description The issue allows any forum user with mod privileges to input an XSS payload into the ban reason. This payload is then executed on the bans.php page, potentially leading to malicious script execution.

Recommendations For Ban List plugin version 1.0, consider disabling the ability for mod-privileged users to input custom ban reasons until a patch is available to prevent XSS payload execution. Restrict access to the bans.php page to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-14724

Produtos afetados

Ban List Plugin

Referências · 3

• 🔥 https://exploit-db.com/exploits/46347 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14724 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-14724 · Aviso do Fabricante