Visual editor persistent Cross-site Scripting (XSS) in MyBB

CVE-2023-46251

What is CVE-2023-46251?

MyBB forum software is susceptible to a DOM-based cross-site scripting (XSS) vulnerability stemming from inadequate input escaping for custom MyCode (BBCode) in the visual editor (SCEditor). This flaw allows attackers to exploit the vulnerability by crafting malicious MyCode messages, which when rendered in a post or a Private Message, can execute arbitrary JavaScript in the context of the victim. The risk is heightened on pages where message content is dynamically populated through GET/POST parameters or on reply pages that reference previously saved messages. To mitigate this vulnerability, it is recommended to disable the visual editor globally in the admin settings or for individual users within their profile settings. Users are strongly encouraged to upgrade to MyBB version 1.8.37, which includes the necessary fixes to address this security issue.

References