[Paranoid‌]

Thanks for the alert Omni, hopefully nothing happens.

[RƎDSPY]

Most of my passwords are random jitters that I can't even remember.

Thanks for the update.
bruh

[NoScript]

Thanks for the warning, Omniscient!

[Noire Dragon]

Is this all versions of mybb or older (1.6.x) ? What is the CSRF like just sending a post or what lol?

[adampelletgun]

Thanks for the heads up.

Another few tips:

1. Never click coded hyperlinks from members. Always quote the PM/post to see the URL.
2. Never click hidden links. Links such as goo.gl. There are online tools out there that you can use to unmask these links.

[Noire Dragon]

I'm a bit confused about the nature of the exploit but I guess I won't worry. Thanks for the heads-up though, glad I will be aware if / when it hits the news.

XSRF I believe basically does on site functions such as posting a message or private messaging someone via a script on a remote site if you're logged in on the target site depending on the exploit it could be worst than posting a message.

['An0ny]

Thanks for the heads up.

Another few tips:

1. Never click coded hyperlinks from members. Always quote the PM/post to see the URL.
2. Never click hidden links. Links such as goo.gl. There are online tools out there that you can use to unmask these links.

For goo.gl you can just add a + sign behind the link, example, http://goo.gl/aEhE+

I'll defiantly not open links, hopefully booters dosen't use this exploit.. that would be bad lol

---

Let the asslicking begin!

"Thank you omni, may i kiss you ass now for the ass kisser award?"

you may want to shut the fuck up and try better next time 🤐

[STR™]

Thank you for the heads up Omni Sir , will follow your command

[Noire Dragon]

You know they can always use your email instead of the username...

They shouldnt be able to get/change the password via the xsrf bug anyway you should be safe.

[what is life]

Thank you for the heads up!

Saw some Skype messages on this

['An0ny]

You know they can always use your email instead of the username...

Ends up requiring them to have hes mail - which I doubt.

[Programming]

If anyone downloads shit they aren't 100% sure is legit; they deserve to have their accounts taken.

[Noire Dragon]

Yes, because HF accounts are valued.

There is no exploit. That's the point of this thread. In the near future I'm expecting rumors that one exists when in-fact it doesn't.

The bug is more like saying your car can explode if you throw a molotov cocktail at it. Simply don't throw the molotov cocktail at your car if you want to stay safe. Pretty basic really.

Oh aren't you cute, I was looking for XSRF/XSS vulnerabilities on my test mybb installation..seems like a common sense "exploit" alert thread. 😵

[Sceptical]

Thanks for this great heads up news Omni this should help me keep my account for a long time.

[Krew]

I thought the MyBB CSRF vulns were all fixed upon the implentation of postkeys?