MyBB Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2023-46251

MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn39t escape input properly when rendering HTML resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter or on reply pages where a previously saved malicious message is quoted. The impact is be mitigated when: 1. the visual editor is disabled globally (_Admin CP Configuration Settings Clickable Smilies and BB Code: a hrefhttps://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xmlL2087-L2094Clickable MyCode Editor/a_ is set to _Off_) or 2. the visual editor is disabled for individual user accounts (_User CP Your Profile Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked). MyBB 1.8.37 resolves this issue with the commit code6dcaf0b4d/code. Users are advised to upgrade. Users unable to upgrade may mitigate the impact without upgrading MyBB by changing the following setting (_Admin CP Configuration Settings_): - _Clickable Smilies and BB Code a hrefhttps://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xmlL2087-L2094Clickable MyCode Editor/a_: _Off_. Similarly individual MyBB forum users are able to disable the visual editor by diabling the account option (_User CP Your Profile Edit Options_) _Show the MyCode formatting options on the posting pages_.