MyBB MyChat Shoutbox Spamming & CSRF 0day Exploit

Hi guys,
this tutorial and exploit writer by my friend 1337 (leet hax0r)
I found that MyChat Shoutbox plugin is vulnerable to users spamming as a Guest (Spamming without registering on the forum) and vulnerable to CSRF.
Plugin has no security token to POST data. Therefor it is vulnerable to CSRF also.
Lets see how it works:

Code:

http://target.com/mychat.php?action=insert&message=1337

The above link will submit a message http://www.MaDLeeTs.com with out any problem. If you are not logged in, you can submit messages as a Guest.

To see results, you can see it on the forums index if admins have allowed chatbox to be seen by Guests. If Guests can not see it on forums index, they can see it by the link below:

Code:

http://xnonymoux.org/mychat.php?action=update

You can troll an admin by adding http://target.com/mychat.php?action=insert&message=1337 in a iframe and submit it via PM to the admin of the forum. Once he opens it, a message will be posted by his account. If messages can be seen as a Guest on forum index, you can make your targets forum admin submit a HaCked message with your code-name by replacing 1337 . Once done, mirror it on Zone-H and it might be approved since you where not authorized to submit such messages by admins account 

Here is a site that you can play with 
Live Demo:

Code:

http://xnonymoux.org/mychat.php?action=insert&message=1337

What ever you submit in message= will be displayed here:

Code:

http://xnonymoux.org/mychat.php?action=update

Note: If you refresh mychat.php?action=insert&message=1337 page, and hold F5. It will flood targets chatbox
Have fun 

Exploit by 1337 - TeaM MaDLeeTs
http://www.MaDLeeTs.com