New eVuln Advisory:=0D
MyBB 'Avatar URL' XSS Vulnerability=0D
http://evuln.com/vulns/132/summary.html=0D 
=0D
--------------------Summary----------------=0D
eVuln ID: EV0132=0D
Vendor: MyBB Group=0D
Vendor's Web Site: http://www.mybboard.com/=0D 
Software: MyBB=0D
Sowtware's Web Site: http://www.mybboard.com/=0D 
Versions: 1.1.6 and earlier=0D
Critical Level: Moderate=0D
Type: Cross-Site Scripting=0D
Class: Remote=0D
Status: Unpatched. No reply from developer(s)=0D
PoC/Exploit: Available=0D
Solution: Available=0D
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)=0D
=0D
-----------------Description---------------=0D
Every user has an ability to edit his avatar URL. Avatar URL is not properly sanitized. This can be used to post arbitrary web script code using 'Tab' symbol.=0D
=0D
--------------PoC/Exploit----------------------=0D
Available at: http://evuln.com/vulns/132/exploit.html=0D 
=0D
--------------Solution---------------------=0D
Solution is available at vendors web site:=0D
=0D
Upgrade you copy of MyBB to the 1.1.7 version.=0D
=0D
http://www.mybboard.com/=0D 
=0D
--------------Credit-----------------------=0D
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)=0D
=0D
=0D
Regards,=0D
Aliaksandr Hartsuyeu=0D
http://evuln.com - Penetration Testing Services