This host is running MyBB and is prone to cross site scripting vulnerability.

Successful exploitation will allow remote attackers to steal the victim's cookie-based authentication credentials. Impact Level: Application.

Upgrade to version 1.6.13 or later, For updates refer to http://www.mybb.com

The flaw is due to an input passed via the 'keywords' parameter to 'search.php', which is not properly sanitised before using it.

MyBB version 1.6.12, Other versions may also be affected.

Send a crafted exploit string via HTTP POST request and check whether it is able to read the string or not.

• http://osandamalith.wordpress.com/2014/02/02/mybb-1-6-12-post-xss-0day/

---

Updated on 2017-03-28