CVE-2018-17128

published 2018-09-17

CVE-2018-17128: A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.

Priority P3 51 medium 5.4 CVSS 3.0

AV N AC L PR L UI R S C C L I L A N

EXPLOIT

A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
mybb	mybb	< 1.8.19	1.8.19

Detection & IOCs extracted from sources · hover to see the quote

path editpost.php↗

path newreply.php↗

path private.php↗

command [video=PAYLOAD]http://victim.com[/video]↗

• → Monitor POST/GET requests to editpost.php, newreply.php, newthread.php, and private.php for MyCode video tags containing unexpected or script-like content in the 'videotype' (video source) parameter — the pattern [video=<payload>]...[/video] is the attack vector. ↗
• → Flag any MyBB Video MyCode tag where the video type/source field contains characters or sequences inconsistent with legitimate video platform identifiers (e.g., angle brackets, JavaScript keywords, event handlers), as the XSS payload is injected into the video source selector. ↗

• · This is a stored (Persistent) XSS — the payload is saved in the post body and executes when any victim loads the Visual Editor on an affected page, not only on initial submission. Scanning only at write-time will miss the stored payload. ↗
• · All MyBB instances running versions up to and including 1.8.18 are affected; the fix is present only in 1.8.19 and later. ↗

CVSS provenance

nvd v3.0 5.4 MEDIUM CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 3.5 LOW AV:N/AC:M/Au:S/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79