Source: http://www.securityfocus.com/bid/6337/infoProblems with vBulletin could make it possible for an attacker to inject arbitrary HTML in vBulletin forum messages. |
vBulletin
does not sufficiently filter potentially malicious HTML code from
posted messages. As a result, when a user chooses to view a message
posting that contains malicious HTML code, the code contained in the
message would be executed in the browser of the vulnerable user. This
will occur in the context of the site hosting the vBulletin forum
software. |
Attackers
may potentially exploit this issue to manipulate web content or to
steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user. |
This
should only be considered an issue if HTML has been enabled in
messages. This option is not enabled by default and the vendor
recommends that users do not enable it. If the option has been enabled,
HTML will not be filtered at all. |
***
This vulnerability has been further investigated. It has been reported
by the vendor that this functionality is by disabled by default.
Additionally, the risks of enabling this feature are documented in the
user manual. Therefore, this is not a valid vulnerability, and will be
removed from the SecurityFocus Vulnerability Database. |
<b onMouseOver="alert(document.location);">Test!</b>Nguồn: http://www.exploit-db.com/exploits/22077/ 
0 nhận xét:
Đăng nhận xét