CVE-2023-27890 in Export User Plugin
Summary
by MITRE • 04/14/2023
The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/27/2025
The CVE-2023-27890 vulnerability resides within the Export User plugin version 2.0 and earlier for the MyBB forum software platform, representing a cross-site scripting flaw that specifically manifests during administrative data export operations under GDPR compliance procedures. This security weakness occurs when administrators attempt to generate data exports for users while processing personal information requests, creating an attack surface that exploits the plugin's handling of user profile fields.
The technical exploitation of this vulnerability targets three specific user profile fields: Custom User Title, Location, and Bio, which are commonly used to store personalized information within MyBB installations. When an administrator processes a GDPR data export request, the plugin fails to properly sanitize or escape user input contained within these fields before displaying the exported data back to the administrative interface. This lack of input validation creates a persistent cross-site scripting vector that allows malicious actors to inject malicious scripts into user profiles, which then execute in the context of other administrators' browsers when they view the export data.
The operational impact of this vulnerability extends beyond simple script execution, as it represents a critical security flaw that enables attackers to gain elevated privileges within the administrative interface. The vulnerability specifically affects installations where administrators are processing personal data requests under GDPR compliance requirements, making it particularly dangerous in environments where data protection regulations are actively enforced. Attackers could potentially steal administrative session cookies, modify user permissions, or even execute arbitrary commands within the context of the MyBB installation, depending on the administrative privileges of the compromised user.
This vulnerability aligns with CWE-79 Cross-site Scripting and follows patterns commonly associated with the ATT&CK technique T1059.001 Command and Scripting Interpreter, where malicious scripts can be executed through web-based interfaces. The issue demonstrates poor input sanitization practices and highlights the importance of validating all user-provided data within administrative interfaces, particularly when handling sensitive personal information. The fact that this vulnerability only affects unsupported products underscores the critical need for organizations to maintain current software versions and security patches.
Mitigation strategies should prioritize immediate software updates to supported versions of the Export User plugin or MyBB itself, as the original software is no longer maintained by developers. Organizations should implement additional input validation measures at the application level, including proper HTML escaping of user-generated content before display in administrative interfaces. Network-based mitigations such as web application firewalls can provide additional protection layers, though the most effective approach involves comprehensive patch management and regular security assessments of all installed software components. Security teams should also consider implementing monitoring for suspicious administrative activities and user profile modifications that might indicate exploitation attempts.