Vanilla Forum Tagging Plugin Enchanced 1.0.1 – Persistent Cross-Site Scripting

• Exploit Database
• 117 阅读

• 作者： Henry Hoggard
  日期： 2012-06-02
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18974/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

  # Title: Vanilla Tagging Enchanced 1.0.1 Stored XSS # Date: 1/6/12 # Author: Henry Hoggard # Author URL: henryhoggard.co.uk # Author Twitter: @henryhoggard # Software: Vanilla Version 2.0.18.4 + Tagging Enhanced plugin 1.0.1 # http://vanillaforums.org/download # http://vanillaforums.org/addon/tagging-plugin   This plugin is based on the default tagging plugin that comes with Vanilla. Therefore this is vulnerable to the same attack.   Create a new thread and post your XSS as tag. I used <script>alert(&apos;xss&apos;)</script>   You will have to use a proxy / manipulate the form to bypass the max-length on the form.   Once you have posted the thread, send an administrator or moderator to   http://target.tld/index.php?p=/vanilla/post/editdiscussion/7   Where 7 is the thread ID of the thread you just made. The XSS will then trigger. You can even use a URL shortener to send the link.   Note: The URL may be different depending on what category your thread is in.   #############################################################