MYBB VERSION 3.0.0 XSS BUG SHIT !!TESTED!!

[mesvak]

[hide]

# Exploit Title: MyBB Thank  Like Plugin 3.0.0 - XSS
# Date: 10/3/2018
# Author: Mesvak
# Version: 3.0.0
# Tested on: KALI
# CVE: CVE-2018-14888


1. Description:
This plugin allows users to thank/like other users threads/posts. In user profiles it shows your most liked post/thread, the post/thread subjects aren't sanitized to user input.
 

2. Proof of Concept:

- Use the following as the post/thread subject  <script>alert('XSS')</script>
- Get that post/thread liked by another user (or you)
- Visit your profile to see alert.

[/hide]

soLUTION IS UPDATING TO NEW VERSION OF ASS 

Now fuck off XD [size=large][size=x-large]Dont[/size] forget to lib a like all creds goes to mesvak cz i m the on who is leeching them XD  

 

 

 

[/size]

 

[Ahmad786]

thnx man good job

 

[Jelously991]

thank you xxxx

 

[pass2019]

lets check it out and see if it works

 

[PostmanTap]

thank you very cool

 

[KingDaniels]

Lets check it out

 

[FurkanGM]

thank you bro.

 

[charles15151]

soLUTION IS UPDATING TO NEW VERSION OF ASS 

Now fuck off XD [size=large][size=x-large]Dont[/size] forget to lib a like all creds goes to mesvak cz i m the on who is leeching them XD  

 

 

 

[/size]

Wait so how does this work? Im new to this.

 

[punahin]

ahaaa i finally found thiss tool thnks