Description

MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fields() only performs the specialized validation when is_array($profile_fields[$field]) is true. A non-array profile_fields[fidX] value instead of the expected profile_fields[fidX][] shape falls through to generic text handling and is stored without verification. The affected value is then rendered directly by member.php and inc/functions_post.php rather than processed by the MyCode parser. The uniquely identifying implementation details include inc/datahandlers/user.php. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-18T16:17:06.347Z",
  "pubdate": "2026-08-18T16:17:06.347Z",
  "executiveSummary": "A stored JavaScript code injection vulnerability exists within MyBB prior to version 1.8.40. The vulnerability stems from improper input validation of checkbox and multiselect profile field types within the user datahandler.\nThe impact of this security flaw allows an authenticated attacker to inject and persistently store malicious JavaScript payload strings within user profile fields. When affected profile fields are rendered by the application, the injected scripts execute in the context of other users' browsers.\nAffected systems include MyBB forum software versions prior to 1.8.40. The risk implications encompass potential session hijacking, cross-site scripting (XSS), and unauthorized actions performed on behalf of victims viewing the compromised profile data.\nAttacker capabilities require standard user access to modify profile data, successfully supplying malformed input structures that bypass standard validation checks. Exploitation relies on the application rendering the unverified stored data directly without sanitization or MyCode parser processing.",
  "technicalDetails": "The root cause of the vulnerability resides in the validation logic implemented within UserDataHandler::verify_profile_fields() located in inc/datahandlers/user.php. Specifically, the datahandler is designed to validate checkbox and multiselect profile field types only when the condition is_array($profile_fields[$field]) evaluates to true.\nWhen an attacker supplies a non-array value for profile_fields[fidX] instead of the expected profile_fields[fidX][] array shape, the validation routine fails to execute the specialized checks intended for these field types. Instead, the malformed input falls through to generic text handling logic.\nThe generic handling mechanism stores the unverified input directly into the database without proper sanitization or encoding. Consequently, when the affected profile field value is subsequently retrieved and rendered directly by member.php and inc/functions_post.php rather than passing through the MyCode parser, the raw JavaScript payload is outputted directly to the DOM.\nThe attack flow proceeds as follows: First, an authenticated user crafts an HTTP request modifying their profile fields, substituting the expected array parameter with a malicious scalar string containing JavaScript code targeting a checkbox or multiselect field fidX. Second, the UserDataHandler processes the input, incorrectly routes the scalar value through generic text handling due to the absence of array validation, and persists the payload in the database. Third, when a victim navigates to member.php or views posts where inc/functions_post.php renders the profile data, the application embeds the unescaped script into the HTTP response. Finally, the victim's browser executes the malicious script, achieving stored cross-site scripting and potential session compromise.\nVulnerable components include inc/datahandlers/user.php, member.php, and inc/functions_post.php in MyBB versions prior to 1.8.40. Exploitation requires network exposure to the web application, an authenticated session to modify profile parameters, and standard user privileges."
}