CVE-2018-25248
HIGHMyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2018-25248. PoCs published by 0xB9.
AI-analyzed exploit summary The exploit describes a persistent XSS vulnerability in MyBB Downloads Plugin v2.0.3, where an attacker can inject malicious JavaScript into the title field of a new download, which executes when an admin reviews it. The proof of concept is straightforward and relies on user input being rendered without proper sanitization.
Description
MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the download title field. Attackers can submit a new download with HTML/JavaScript code in the title parameter, which executes when administrators validate the download in downloads.php.
Exploits (1)
The exploit describes a persistent XSS vulnerability in MyBB Downloads Plugin v2.0.3, where an attacker can inject malicious JavaScript into the title field of a new download, which executes when an admin reviews it. The proof of concept is straightforward and relies on user input being rendered without proper sanitization.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N