MyBB ChangUonDyU Plugin 1.0.2 - Cross-Site Scripting

 # Date: 5/25/2018 
 # Author: 0xB9 
 # Twitter: @0xB9Sec 
 # Contact: 0xB9[at]pm.me 
 # Software Link: https://community.mybb.com/mods.php?action=view&pid=1125 
 # Version: 1.0.2 
 # Tested on: Ubuntu 18.04 
 # CVE: CVE-2018-11532 


 1. Description: 
 This plugin displays advanced statistics on the index page such as latest posts with auto refresh using AJAX. 



 2. Proof of Concept: 
 Create a new thread with the following payload as the title  <svg onload=alert('XSS')> 

 The alert will appear on the index page 



 3. Solution: 
 Update to the latest release