[Icey.]

Hello,

Here is a minor xss that has almost no impact but thought i would share it because i'm to lazy to report it.

Code

usercp.php?action=do_editlists&my_post_key=key&manage="{any html}&delete=id

Problem:
They have not sanitized the output that happens when removing someone from the friendlist.

Here is the code:
https://github.com/mybb/mybb/blob/e99ec5....php#L3233

[linkinpork]

Code

usercp.php?action=do_editlists&my_post_key=key&manage="{any html}&delete=id

Problem:
They have not sanitized the output that happens when removing someone from the friendlist.

Hi,

There's a CSRF token required to run the do_editlists function, along with the myBB secret token that you use for posts. The myBB secret is static, but cannot be extracted unless you proxied the victim (since it is placed in POST data, not Set-Cookie). The CSRF token is also POST data.

You can argue that this is doable with MITM though, but that beats the point of weaponization.

POC: