Cross-Site Scripting and Cross-Site Request Forgery in MyBB Trash Bin Plugin
CVE-2018-14575
8.8HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2018-14575?
The Trash Bin plugin for MyBB version 1.1.3 is susceptible to cross-site scripting (XSS) vulnerabilities through user-supplied thread subjects. Additionally, it exhibits cross-site request forgery (CSRF) behaviors via post subjects which could allow attackers to execute unauthorized commands on behalf of the user. Proper sanitation of input data and protection mechanisms against CSRF attacks are essential to mitigate these risks.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.