Extended Useradmininfo MyBB Plugin 1.2.1 - Cross Site Scripting

vendor:

Extended Useradmininfo Plugin

by:

Fikri Fadzil

7,5

CVSS

HIGH

Cross Site Scripting

CWE

Product Name: Extended Useradmininfo Plugin

Affected Version From: 1.2.1

Affected Version To: 1.2.1

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: PHP

2014

Extended Useradmininfo MyBB Plugin 1.2.1 – Cross Site Scripting

This plugin shows advanced Informations about a user, such as last IP, User Agent, Browser and Operating System. The information will be shown in a user profile and visible only for people who are able to see the adminoptions on user profiles. Proof of Concept: 1. Create a user account. 2. Change your user-agent to 'Mozilla<script>alert(1)</script>'. 3. Login and then... logout. The script will be executed whenever the administrator view your profile.

Mitigation:

Replace the content of 'inc/plugins/extendeduseradmininfos.php' with the fix provided in the text.

Source

Exploit-DB raw data:

# Exploit Title: Extended Useradmininfo MyBB Plugin 1.2.1 - Cross Site
Scripting
# Google Dork: N/A
# Date: 09.02.2014
# Exploit Author: Fikri Fadzil - fikri.fadzil@impact-alliance.org
# Vendor Homepage: http://forum.mybboard.de/user-9022.html
# Software Link: http://mods.mybb.com/view/extended-useradmininfo
# Version: 1.2.1
# Tested on: PHP

Description:
This plugin shows advanced Informations about a user, such as last IP, User
Agent, Browser and Operating System. The information will be shown in a
user profile and visible only  for people who are able to see the
adminoptions on user profiles.

Proof of Concept
1. Create a user account.
2. Change your user-agent to "Mozilla<script>alert(1)</script>".
3. Login and then... logout.

* The script will be executed whenever the administrator view your profile.


Solution:
Replace the content of "inc/plugins/extendeduseradmininfos.php" with this
fix:
http://pastebin.com/ncQCvwdq