Re: Re: New Include Redirect Bug XSS All vBulletin(r) v 3.x.x

I fully understand the significance of XSS and the numerous different ways to get it on the server but this focuses directly on the ability to place a web viewable document on the same domain which vBulletin doesn't provide itself.

What the author of this exploit has described is a way to influence a user to visit a link to a crafted page already present on the domain, it isn't traversing out of the directory, its only changing the value of a src or an href parameter.

Short of removing the ability for users to provide links there isn't a way to fix this, and even if we did they could just put the link on anyway and have someone copy and paste.

In my eyes it isn't even an exploit at all, if you can create unsanitised content that is web viewable then there is a more significant problem that needs resolved and it out of our scope to fix.

Scott MacVicar

Relevant Pages

  • Cant give user rights to add pc to the domain
    ... past posts, however, I have not been able to fix my problem. ... I am trying to give a user in our company the ability to add pc's to ... and give him permissions there. ... server, to win 2003 server last week. ...
    (microsoft.public.windows.server.general)
  • Add PC to domain Problem
    ... past posts, however, I have not been able to fix my problem. ... I am trying to give a user in our company the ability to add pc's to ... and give him permissions there. ... server, to win 2003 server last week. ...
    (microsoft.public.win2000.security)
  • Re: OT: Who looks forward to work?
    ... I'm a warehouse monkey. ... You can fix that. ... I can't claim that you have the personality to work ... lack the ability to "read" people. ...
    (uk.rec.motorcycles)
  • Re: Are the results of IQ test really valid ?
    ... My mother for instance, probably would have scored very low in an IQ test, but when it came to playing bridge she had one ability that I could never have. ... That was her unique ability to remember every card played by every person, throughout the game. ... I would think the answer to your quesiton is, what are the odds of someone who is smarter than someone else, be able to learn how to fix a car with some instructions. ...
    (soc.retirement)
  • Re: MS Office update 2000 -> 2003 killed Outlook Express
    ... I am expected to fix the encountered serious side problem ... (wrecking of OE and loss of ability to send email), ... since lack of ability to use their databases, etc., ... Updating OE to WLM is perceived as progress, ...
    (microsoft.public.windowsxp.general)