vbulletin < 3.6.6 [permanent xss]
- From: laurent.gaffie@xxxxxxxx
- Date: 16 May 2007 14:12:32 -0000
product:vbulletin < 3.6.6
bug: permanent xss
affected file: calendar.php
risk : medium
xss permanent ( must be loggued ) PoC :
--> fill up the title field with :
Event Date : ( some far away date ... like 2010 for exemple )
message : whatever .
when it's done look at the :"Request Reminder for this Event" link.
(it looks like this: http://127.0.0.1/vbulletin/calendar.php?do=addreminder&e=2)
if you click,your XSS will be executed .
permanent xss are dangerous ...
see : http://en.wikipedia.org/wiki/Cross_site_scripting
regards laurent gaffié
- Prev by Date: Re: Defeating Citibank Virtual Keyboard protection using screenshot method
- Next by Date: RE: Defeating Citibank Virtual Keyboard protection using screenshot method
- Previous by thread: I, Bot. Taking advantage of robots power (Article)
- Next by thread: ANNOUNCE: RFIDIOt version 0.1m released (May 16th 2007)