MyBB (aka MyBulletinBoard) before 1.4.12 allows remote authenticated users to bypass intended restrictions on the number of [img] MyCodes by editing a post after it has been created.
MyBB versions prior to 1.4.12 are vulnerable to a remote authenticated attack that allows users to bypass restrictions on the number of image tags ([img] MyCodes) within a post. This vulnerability could be exploited to potentially cause denial of service (DoS) or, in some scenarios, facilitate cross-site scripting (XSS) attacks by injecting malicious HTML or JavaScript.
Step 1: Authentication: The attacker must have a valid, authenticated user account on the MyBB forum.
Step 2: Initial Post Creation: The attacker creates a post, potentially including a limited number of [img] tags, adhering to the initial restrictions.
Step 3: Post Editing: The attacker edits the previously created post.
Step 4: Payload Insertion: During the edit, the attacker adds a number of [img] tags exceeding the original limit.
Step 5: Post Submission: The attacker submits the edited post.
Step 6: Vulnerability Trigger: The MyBB software processes the edited post without properly validating the number of [img] tags, allowing the excessive tags to be saved.
Step 7: Exploitation (DoS/XSS): The excessive number of images could lead to a DoS by consuming server resources, or if the image tags are not properly sanitized, XSS could be achieved.
The vulnerability stems from a flaw in how MyBB handles the editing of posts after they have been initially created. The software enforces a limit on the number of [img] tags during the initial post creation. However, the validation logic is not consistently applied when a user subsequently edits the post. This allows an attacker to bypass the initial restriction by adding more [img] tags during the edit process. The root cause is a missing or insufficient check on the number of [img] tags during the post update operation. This could lead to resource exhaustion if a large number of images are embedded, potentially causing a denial-of-service (DoS) condition. Furthermore, if the application doesn't properly sanitize the image tags, it could be exploited for cross-site scripting (XSS) attacks if the attacker can control the image source or other attributes.