Unpatched MyBB sites vulnerable to remote takeover

guest · Jun 11, 2019

Unpatched MyBB sites vulnerable to remote takeover
June 11, 2019
https://portswigger.net/daily-swig/open-forum-unpatched-mybb-sites-vulnerable-to-remote-takeover

Launched yesterday, version 1.8.21 of MyBB includes fixes to numerous security issues, including a critical stylesheet vulnerability that could result in remote code execution (RCE), giving an attacker full access to all user accounts, private threads, and messages stored in the board’s database.

Code execution can be achieved through a persistent cross-site scripting (XSS) flaw in the software’s nested video feature.
“We discovered a stored XSS vulnerability that occurs due to a parsing error in posts and private messages in MyBB 1.8.20 and prior versions, as well as an authenticated remote code execution vulnerability that can be exploited by administrators of a forum,” Scannell told The Daily Swig.

“This leads to a full remote takeover of a target board by an attacker, as soon as an administrator – who is at the same time authenticated in the backend context – opens the malicious private message,” he said.
“No further user interaction is required.”
Click to expand...

Check out the RIPS Tech blog post for a full technical breakdown of the vulnerabilities.
Click to expand...

guest · Jun 24, 2019

User data stolen from ‘human hacking’ forum Social Engineered, published on rival site
A vulnerability in MyBB has been blamed
June 24, 2019
https://www.zdnet.com/article/user-...um-social-engineered-published-on-rival-site/

A forum dedicated to the art of social engineering, Social Engineered, has been compromised and its users' data leaked on a rival website.

The data breach occurred on June 13, 2019. The details of the forum users, including 89,000 unique email addresses linked to 55,000 forum account holders, usernames, IP addresses, and passwords stored as salted MD5 hashes were published and leaked online.
In a blog post penned on Thursday by the owner of Social Engineered, nicknamed Snow101, a vulnerability in MyBB is to blame for the leak.

Social Engineered has now moved over to the XenForo platform in an attempt to prevent a repeat of the data breach. The forum owner has asked members to voluntarily donate towards the shift from a free, open-source project to a commercial forum.
Click to expand...

Log in or Sign up

Unpatched MyBB sites vulnerable to remote takeover

guest Guest

guest Guest

Log in or Sign up

Unpatched MyBB sites vulnerable to remote takeover

guest Guest

guest Guest

Useful Searches