Executive brief
The MyBB Downloads plugin, which allows users to share files on a forum, contains a security flaw that lets regular members inject malicious scripts into download titles. When a forum administrator attempts to review or validate these new downloads, the malicious code executes in their browser. This could allow an attacker to hijack administrative sessions, perform unauthorized actions, or compromise the forum's management interface.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in the MyBB Downloads Plugin version 2.0.3. The vulnerability is located in the 'title' parameter of the download submission process within downloads.php. Regular authenticated users can submit a new download entry containing malicious HTML or JavaScript payloads. Because the application fails to properly neutralize this input, the script executes in the context of an administrator's session when they view the pending download for validation. This can lead to session hijacking or unauthorized administrative actions. A patch was reportedly submitted via a GitHub pull request to the plugin repository.
Affected products
- MyBB Downloads Plugin 2.0.3
Timeline
- 2018-03-28: disclosed: Vulnerability discovered by researcher 0xB9
- 2018-04-05: other: Exploit published on Exploit-DB
- 2026-04-04: advisory: NVD/VulnCheck advisory published