Vulnerable Systems:
*Profile Wii Friend Code Plugin for MyBB 1.0
Profile Wii Friend Code Plugin for MyBB contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'Wii Friend Code' field upon submission to the profilewfc.php script. This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.
Persistent XSS:
1. Go to your user cp and edit your profile - usercp.php?action=profile
2. and at the "Wii Friend Code Wii Friend Code" box enter: <script>alert(1)</script> and then press submit
3. http://prntscr.com/o1x2p, submit, and http://prntscr.com/o1x69
Disclosure Timeline:
Disclosure Date :2013-01-04
Exploit Publish Date :2013-01-04
