Vanilla Forums About Me Plugin – Persistent Cross-Site Scripting
# Title: Vanilla About Me Plugin Persistant XSS Vulnerability # Date: 18/5/12 # Author: Henry Hoggard # Author URL: henryhoggard.co.uk # Author Twitter: @henryhoggard # Software: Vanilla Version 2.0.18.4 + About Me 1.1.1 # http://vanillaforums.org/addon/aboutme-plugin # http://http://vanillaforums.org ############################################################# Go to http://target.tld/index.php?p=/profile/editme/4/testmember Post your XSS In any of the text fields, for this we used the Real Name Field and the following XSS XSS: <script>alert('x')</script> Then if a user visits your about me page (http://target.tld/index.php?p=/profile/aboutme/4/testmember) the script will execute ############################################################# http://henryhoggard.co.uk |