NBBN has discovered some vulnerabilities in MyBB, which can be exploited can be exploited by malicious people to disclose sensitive information.

The problem is that the "my_post_key" token is included in the "Referer" HTTP header when sending certain requests for e.g. images referencing external web sites (e.g. when performing various moderation actions, like splitting and merging a thread or deleting posts). This can be exploited to disclose a user's secret token by tricking the user into performing an affected operation.

Successful exploitation may open up for various cross-site request forgery and cross-site scripting attacks.

The vulnerability is confirmed in version 1.4.3. Other versions may also be affected.

Solution
Update to version 1.4.4.

Provided and/or discovered by
NBBN

Changelog
Further details available in Customer Area

Original Advisory
http://packetstorm.linuxsecurity.com/0811-exploits/mybb-disclose.txt

Deep Links
Links available in Customer Area