CVE-2024-52702 in MyBB
Summary
by MITRE • 11/20/2024
A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Name parameter. NOTE: this is disputed by the Supplier because Website Name can only be set by an administrator, who may use JavaScript if they wish.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 12/08/2025
The stored cross-site scripting vulnerability identified as CVE-2024-52702 resides within the installation component of MyBB version 1.8.38 specifically in the install/index.php file. This flaw represents a classic stored XSS attack vector where malicious input injected into the Website Name parameter persists within the application's database and executes whenever the affected page is accessed. The vulnerability demonstrates a critical weakness in input sanitization and output encoding practices within the MyBB installation process, creating an opportunity for attackers to compromise user sessions and execute malicious code in the context of affected web applications.
The technical implementation of this vulnerability stems from insufficient validation and sanitization of user-supplied input during the installation process. When administrators configure the Website Name parameter, the application fails to properly escape or filter special characters that could be interpreted as HTML or JavaScript code. This allows attackers to inject malicious payloads that are then stored and subsequently executed whenever legitimate users access pages that display this information. The stored nature of this vulnerability means that the malicious code remains persistent in the application's database until manually removed, making it particularly dangerous as it can affect multiple users over time. According to CWE-79, this vulnerability directly maps to the classic Cross-Site Scripting weakness where applications fail to properly encode output, allowing attackers to inject malicious scripts into web pages viewed by other users.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform session hijacking, steal sensitive information, redirect users to malicious sites, or even escalate privileges within the application. The fact that this vulnerability occurs during the installation phase presents a particularly concerning attack surface since installation processes are often performed by administrators with elevated privileges, potentially allowing attackers to gain deeper access to the application. From an ATT&CK framework perspective, this vulnerability aligns with techniques such as T1059.007 for command and scripting interpreter and T1531 for account access removal, as it could enable attackers to manipulate application behavior and user access. The disputed nature of this vulnerability by the supplier highlights a critical debate in security assessments regarding the scope of potential attack vectors and the assumption that administrative inputs are inherently trusted.
While the vendor has argued that Website Name can only be set by administrators who may legitimately use JavaScript, this defense overlooks the fundamental security principle that even trusted inputs should be properly validated and sanitized. The vulnerability demonstrates that the installation process lacks proper input validation controls, creating a pathway for malicious code injection that could be exploited by attackers who gain access to administrative credentials or who can manipulate the installation process through other means. Organizations should implement comprehensive mitigations including input validation at all stages of application processing, proper output encoding, and regular security assessments of installation and configuration processes. The vulnerability underscores the importance of principle of least privilege and proper input sanitization even for administrative functions, as demonstrated by the Common Weakness Enumeration standards and the MITRE ATT&CK framework's emphasis on preventing and detecting such injection attacks.