[Punisher]

Hey guys,

I was messing around trying to find possible security incidents that could affect members and stumbled across two XSS reflection exploits.

The two vulnerable pages were the Buy Sticky and Sales Tags, both have been patched since reporting.

Glad to help keep everyone safe!  🤝

Proof:
Spoiler (Click to View)

[vad0x]

Lol nice find man!! Im surprised omni didnt give you a award or anything

[iNuke]

That is so cool, nice one mate. A cool bragging thread 🙂

[Punisher]

Lol nice find man!! Im surprised omni didnt give you a award or anything

Thanks!
That would be awesome!

That is so cool, nice one mate. A cool bragging thread 🙂

Appreciate it, thanks for the kind words man

[Crystallize.]

That is awesome dude Ive been watching your replies when you were helping Omni in some threads, good job!

[Mr. Robot]

I hope you get signature privileges back, assuming these were based on the recent mybb ones reported hence the timing between them?

[ᴇccy]

Thanks for keeping us safe (:

[Elitas]

Good job dude. I'd love to hear the actual PoC so I can maybe learn from this. I read your post on XMPP earlier and it inspired me to do a little bit of hunting myself.

I'm pretty sure I've tested out those pages before too though!

[Punisher]

I hope you get signature privileges back, assuming these were based on the recent mybb ones reported hence the timing between them?

Thanks, I really appreciate it - indeed that was my request to him, but I don't know if I will get them back

I reported a bypass on signature/post restrictions, a recent bug in a mycode tag that the mybb team is patching, and now these two XSS reflections

[Cypical]

Thought Omni said he would give $10k to someone who found a vulnerability that could potentially affect users.

[Nachfolger]

Why didn't you get the angel wings then?

You got scammed boi.

[Elitas]

Ha! Just found an XSS myself, reporting it now.

Thanks for inspiring me to search for something. Cheers!

[Punisher]

Thanks for keeping us safe (:

No problem! ;D

Good job dude. I'd love to hear the actual PoC so I can maybe learn from this. I read your post on XMPP earlier and it inspired me to do a little bit of hunting myself.

I'm pretty sure I've tested out those pages before too though!

It's in the OP, basically the page accidentally reflected the input from the URL without sanitizing it

That allowed me to close the input box using "> and add anything you want to the page after that

Thought Omni said he would give $10k to someone who found a vulnerability that could potentially affect users.

You have to access his profile from the database or drop a file like config.php to claim that reward

This was more of a reflected string problem. I definitely could have crafted a special link on the vulnerable page that grabbed his session, then sent him a pm saying "hey every time I click this link the page doesn't load properly" and once he loaded the page I could grab his session and login as him. But I enjoy being a member of HackForums and I'm not a malicious person. :D

[ᴇccy]

Ha! Just found an XSS myself, reporting it now.

Thanks for inspiring me to search for something. Cheers!

Damn, wish I knew what XSS meant so I could find one and get my first award.

[Punisher]

Ha! Just found an XSS myself, reporting it now.

Thanks for inspiring me to search for something. Cheers!

Nice work. These threads are great for keeping users aware that clicking links on the internet is not always safe!
Even sites that you think are 100% secure always have a few small bugs
Google, Facebook, etc all face these same issues

It's nice having an unofficial group of users going around the forum auditing security, it allows the good guys the time to report the exploits before they get abused.