mailing list archives
XSS, Redirector and IAA vulnerabilities in MyBB
From: "MustLive" <mustlive () websecurity com ua>
Date: Sun, 1 May 2011 20:17:51 +0300
I want to warn you about Cross-Site Scripting, URL Redirector Abuse and
Insufficient Anti-automation vulnerabilities in MyBB.
Vulnerable are MyBB 1.6.3 and previous versions.
In recently released versions MyBB 1.6.3 and 1.4.16 the developers denied to
fix these vulnerabilities.
For XSS and URL Redirector Abuse the working account at vulnerable forum is
used. About such attacks I wrote in my article Attacks on unprotected login
URL Redirector Abuse (WASC-38):
Insufficient Anti-automation (WASC-21):
In registration form (http://site/member.php?action=register) the vulnerable
captcha is used.
For bypassing of captcha the session reusing with constant captcha bypass
method isn't right for it (unlike login form, even it's the same captcha,
because in this form they made the hole "not completely"). So it's needed to
use half-automated method which described in my project Month of Bugs in
There also can be turned on limitation by IP. The limitation on two
registrations from one IP per 24 hours can't protect completely, because
it's bypassing by using of a proxy. So it's needed to have reliable captcha.
2011.03.18 - announced at my site.
2011.03.25 - informed developers.
2011.04.17 - developers didn't fix these vulnerabilities in released
versions MyBB 1.6.3 and 1.4.16.
2011.04.28 - disclosed at my site.
I mentioned about these vulnerabilities at my site
Best wishes & regards,
Administrator of Websecurity web site
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- XSS, Redirector and IAA vulnerabilities in MyBB MustLive (May 01)