Upcoming Events Plugin up to 1.32 on MyBB upcoming_events.php cross site scripting

Summaryinfo

A vulnerability identified as problematic has been detected in Upcoming Events Plugin up to 1.32 on MyBB. Affected by this issue is some unknown functionality of the file upcoming_events.php. This manipulation causes cross site scripting. The identification of this vulnerability is CVE-2019-9650. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Upcoming Events Plugin up to 1.32 on MyBB and classified as problematic. Affected by this vulnerability is some unknown functionality of the file upcoming_events.php. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

An XSS issue was discovered in upcoming_events.php in the Upcoming Events plugin before 1.33 for MyBB via a crafted name for an event.

The bug was discovered 03/10/2019. The weakness was shared 03/11/2019 (Website). It is possible to read the advisory at exploit-db.com. This vulnerability is known as CVE-2019-9650 since 03/10/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details and also a public exploit are known. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:upcoming_events.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.33 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Upcoming Events Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion