MyBB Community Forums

Hello,

This exploit permit to user to read the shoutbox even if the user is banned or not logged.

Repository : https://github.com/SabriHaddouche/Mybb-Exploit-Shoutbox
Mod : http://mods.mybb.com/view/myshoutbox

Going to give that a try.
Everyone can view the shoutbox without being logged in if the admin decides to. Going to look into that now

Btw, what do you mean by banned? Banned from the shoutbox or the forums?
SpiceFuse shoutbox does not have Shoutbox banning.

Banned from the forum and… some people do not show their shoutbox to the public.

(2011-08-25, 01:08 AM)Blackdown Wrote: [ -> ]Banned from the forum and… some people do not show their shoutbox to the public.

Yes I just figured that out. Fixing it right now.

Thanks!

You're welcome,

the url is here : https://github.com/SabriHaddouche/Mybb-E...ap.php#L41

xmlhttp.php?action=show_shouts

Don't forget to follow me on GitHub, have a nice day !

Just in case someone else reads this thread, MyShoutbox 1.6 has just been released and it fixes the security hole.

Enjoy

Enjoy what?

the fix

Oh

By the way, instead of making it public, perhaps contacting the author would be more clever next time if you find a security hole somewhere else.