vbul366-xss.txt
Posted on 17 May 2007
vendor site:http://www.vbulletin.com/ product:vbulletin < 3.6.6 bug: permanent xss affected file: calendar.php risk : medium xss permanent ( must be loggued ) PoC : http://127.0.0.1/vbulletin/calendar.php?do=add&type=single&c=1 --> fill up the title field with : </title><script>alert(document.cookie)</script> Event Date : ( some far away date ... like 2010 for exemple ) message : whatever . when it's done look at the :"Request Reminder for this Event" link. (it looks like this: http://127.0.0.1/vbulletin/calendar.php?do=addreminder&e=2) if you click,your XSS will be executed . reminder: permanent xss are dangerous ... see : http://en.wikipedia.org/wiki/Cross_site_scripting regards laurent gaffié contact: laurent.gaffie[at]g/**/m/**/a/**/i/**/l.com
