CVE-2008-3966

Vulnerability

MyBB (MyBulletinBoard) versions prior to 1.4.1 contain multiple cross-site scripting (XSS) vulnerabilities. The flaws exist in the handling of user-supplied input in the following files: usercp2.php (referrer field), inc/functions_online.php (location field), and moderation.php (tsubject and psubject fields). An attacker can inject arbitrary web script or HTML through these fields, which are then rendered without proper sanitization [1][2].

Exploitation

A remote attacker can exploit these vulnerabilities by crafting a malicious URL or form submission that includes the injected script in the referrer, location, or subject parameters. No authentication is required; the attacker only needs to trick a victim into visiting a crafted link or submitting a form that triggers the vulnerable code path. The injected script executes in the context of the victim's browser when the affected page is rendered [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, defacement, theft of sensitive data (e.g., cookies, form inputs), or other actions that the victim's session permits. The impact is limited to the privileges of the victim user, but can be escalated if an administrator is targeted [1][2].

Mitigation

The vulnerabilities are fixed in MyBB version 1.4.1, released on September 9, 2008 [1][2]. Users should upgrade to this version or later. No workarounds are documented in the available references. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.