• Downloading from our site will require you to have a paid membership. Upgrade to a Premium Membership from 10$ a month today!

    Dont forget read our Rules! Also anyone caught Sharing this content will be banned. By using this site you are agreeing to our rules so read them. Saying I did not know is simply not an excuse! You have been warned.

Patched Flash Uploader to Fix Known Exploits

Admin

Well-Known Member
Staff member
Administrator
This is a patched version of YUI 2.9.0 uploader.swf as used by vBulletin 4.x for managing multiple file uploads.

An exploit was found in the flash uploader (uploader.swf) file supplied with vBulletin 4.x. This file is part of the Yahoo YUI 2 Library which is end of life and Yahoo have stated that they will not be fixing it. Yahoo recommends that the file is removed as the flash uploader has been deprecated.

vBulletin's recommended fix is to replace the file with an empty file of the same name. If you do this, however, and rely solely on the Ajax uploader you will not be able to select multiple files without further modifications.

This modification is a recompiled version of uploader.swf with the above exploit fixed. An additional potential exploit has also been fixed by disabling a parameter not used by vBulletin.

The YUI source used is provided freely by Yahoo to whom I give full credit.


1) Installation

a) Extract uploader.swf from the .zip file and replace your existing file here:

<forum_root>/clientscript/yui/uploader/assets/uploader.swf

b) Make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"


2) Changes

11th January 2014

The parameter 'allowedDomain' has been sanitised with a REGEX to prevent malicious javascript being passed in a query string.


11th January 2014 v2

Many thanks to FranzBanz (http://www.vbulletin.com/forum/member/449383-franzbanz) for his suggestions

  • finding another exploit (using another parameter). Exploit fixed by setting the parameter (not used by vBulletin) to null.
  • '-' Character added to allowed characters in allowedDomain


Non-Flash Alternative
Please note that if you would rather avoid using flash altogether an alternative workaround is available although there are some compromises/limitations:

Asset Manager / Image Upload Fix to upload multiple files like the Flash uploader


DISCLAIMER
I am not a flash developer, I am just another vBulletin customer trying to keep his members happy!
This file is provided free of charge for the benefit of the vBulletin community. You use it at your own risk!


Copyright © 2013 Yahoo! Inc. All rights reserved.
Redistribution and use of this software in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

Neither the name of Yahoo! Inc. nor the names of YUI's contributors may be used to endorse or promote products derived from this software without specific prior written permission of Yahoo! Inc.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Download tuoitreit.vn_patched_uploader.swf_2014-01-11v2.zip (9.51 KB)
 

Facebook Comments

Similar threads
Thread starter Title Forum Replies Date
Admin Security Exploit Patched in versions 3.5, 3.6, 3.7, 3.8, 4.X, 5.X of vBulletin Vbb released 0
F [Flash Deal] Fshare Ưu Đãi Cuối Tháng, Tải Về Xả Láng Tin tức CNTT 1
N SQLi Dumper 8.2 By fLaSh - Keygen By [RTN] Clean SQL injection 1
N SQLi Dumper 8.2 By fLaSh - Keygen By [RTN] Clean SQL injection 0
N Hướng dẫn SQLi Dumper 8.2 By fLaSh - Keygen By [RTN] Clean Local attack 0
dammechiase Tải game đấm bốc Flash cực hay cho máy tính Trò chơi 0
B Xin code hiêu ứng flash chuột HTML HTML & CSS 1
T 7 Nhược Điểm Của Thiết Kế Web Flash Mã nguồn web 0
khanhsak3r Phần mềm PC Công cụ flash và jailbreak cho iOS Phần mềm 0
Z Youtube Video những pha thoát chết kinh điển của động vật. Phản xạ tốc độ hơn cả the flash Video, clip 0
N Masstel M220 treo logo flash ok Thủ thuật ĐTDĐ 1
F [Theme S40] 2014 Fifa World Cup Brazil (Có skin phát nhạc, Flash) S40 0
Kayashiteru S40 Themes S40] Theme Vào Menu Tự Phát Nhạc, Flash Khá Đẹp S40 0
Admin Share flash desktop 2014 - Hiệu ứng pháo hoa, cành mai trên desktop Sử dụng, chia sẻ, hỏi đáp 0
Admin Asset Manager / Image Upload Fix to upload multiple files like the Flash uploader Add-ons 0
M Tải game contra miễn phí cho máy tính -Download Flash Game contra for PC Trò chơi 0
Admin Adobe Flash Player 11.9.900.117 Final - Hỗ trợ xem flash trên các trình duyệt Phần mềm 0
G Share Code Game Ai Là Triệu Phú Bằng Flash Javascript/ajax 1
Admin NOVA, dự án đèn flash không dây nhỏ gọn dùng cho iPhone và điện thoại Android Tin tức CNTT 0
Admin Thử nghiệm nhanh chụp với flash của iPhone 5s so sánh với iPhone 5 và Lumia 1020 Tin tức CNTT 0
D Share Adobe Flash Player cho aixài Android đây Android, ios, java, windows phone 0
bunvocam9x Share : Flash rồng bay và flash pháo hoa Johncms 0
S Mã hóa và quản lý dữ liệu nhạy cảm trên ổ đĩa Flash Tin tức CNTT 0
G nhan up rom,flash Flash Player11, flash kernel,root,unroot,cai cwm cho galaxy y tai thai binh. Android, ios, java, windows phone 2
Admin Download SWF to MP3 and WAV Converter Portable 2.3 - Chuyển âm thanh trong file flash sang mp3 Phần mềm 0
Admin Share trang tìm hiểu và thiết kế web ấn tượng bằng flash HTML & CSS 0
Admin Download Adobe Flash CS6 Portable - phần mềm thiết kế flash chuyên nghiệp Phần mềm 0
Admin Share game flash oẳn tù tì lột đồ girl Crack, hack, mod, ghép game, ứng dụng 6
Yeukodamnoi Share code tạo hình nền flash trực tuyến Mã nguồn wap 0
Admin Tạo file flash dễ dàng Thiết kế đồ họa 0
tubotocdo Share Flash Happy New Year năm 2013 tặng các bạn ! Mã nguồn web 1
V Share Tao flash nhanh,gọn nhẹ Javascript/ajax 0
Admin Download Flash Decompiler Gold - phần mềm chỉnh sửa file flash Phần mềm 2
S Phần mềm PC Xin phần mềm chỉnh sử flash file .swf Phần mềm 1
Admin Download Adobe Flash CS6 Full Crack Thiết kế đồ họa 2
Admin Share code flash noel đẹp 2013 Mã nguồn web 0
tubotocdo Share flash đồng hồ người que pro cho blog web Mã nguồn web 1
Admin Share zip flash cho WMP Wap builder, wapego, xtgem, wen.ru, wapka, wap4 0
Myshare Công cụ thiết kế mới và Video và hiệu ứng Flash HTML & CSS 0
Admin USB Flash Drives Control v 3.2.0.0 - Giữ an toàn hệ thống bằng cách quản lý kết nối USB Phần mềm 0
L Share Index HTML 5 pro như flash HTML & CSS 2
K Mây Tag( Flash Tags) vBulletin Version: 4.X.X Add-ons 1
K Hướng Dẫn - Cách Đặt Flash Vào Header Và Footer Vbb tutorial 0
Admin Adobe Flash Player 10.1 Android 2.2 (Cập nhật v11.1.115.17) Android, iOS 0
L Xin xin code flash side của tuoitre Vbulletin 5
Kidblood S40 Share theme flash s40v6 giao diện galaxys3 + thay đổi skin media vip S40 0
Admin Thủ thuật Fix Google Chrome Shockwave Plugin Flash Video Crash Problem Sử dụng, chia sẻ, hỏi đáp 1
Admin Share code php tạo hình nền flash trực tuyến Mã nguồn wap 0
B [THEME]Flash HACK sóng 3g không chập chờn by BXZ Thủ thuật ĐTDĐ 1
Admin Share code tạo hình nền flash cho xtgem Wap builder, wapego, xtgem, wen.ru, wapka, wap4 1

Similar threads

New posts New threads New resources

Back
Top