PT-2018-13106 · Mybb · Mybb

0Xb9 · Published 2018-08-28 · Updated 2018-11-08 · CVE-2018-15596

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MyBB version 1.8.17

Description An issue was discovered in the forum RSS Syndication page, where thread titles within title elements of the generated XML documents aren't sanitized, leading to XSS. This can be exploited by generating a URL such as http://localhost/syndication.php?fid=&type=atom1.0&limit=15.

Recommendations For MyBB version 1.8.17, update to a newer version that addresses this issue, as the current version allows for XSS attacks due to unsanitized thread titles in the RSS Syndication page.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-15596

Affected Products

Mybb

References · 4

• 🔥 https://exploit-db.com/exploits/45393 · Exploit
• https://osv.dev/vulnerability/CVE-2018-15596 · Vendor Advisory
• https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15596 · Security Note