Bugtraq mailing list archives
Re: VBulletin AdminCP Index.PHP Multiple Cross-Site Scripting Vulnerability
From: kier () vbulletin com
Date: 7 Feb 2007 10:23:01 -0000
I'm somewhat surprised that the reporter does not list the HTML template editor as a potential XSS attack vector too. Perhaps he considers uploading files via FTP to be a means of attack too? Yes, we allow *authenticated administrators* to enter HTML for certain values. This is the intended behaviour, and should the authenticated site administrator wish to include <script> tags in that HTML that is their perogative. This is not a bug or a security flaw.
Current thread:
- VBulletin AdminCP Index.PHP Multiple Cross-Site Scripting Vulnerability DoZ (Feb 06)
- <Possible follow-ups>
- Re: VBulletin AdminCP Index.PHP Multiple Cross-Site Scripting Vulnerability kier (Feb 07)