Vanilla Forum Tagging Plugin Enchanced 1.0.1 - Persistent Cross-Site Scripting

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1063758 漏洞类型
发布时间 2012-06-02 更新时间 2012-06-02
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/18974
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
# Title: Vanilla Tagging Enchanced 1.0.1 Stored XSS
# Date: 1/6/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# Software: Vanilla Version 2.0.18.4 + Tagging Enhanced plugin 1.0.1
# http://vanillaforums.org/download
# http://vanillaforums.org/addon/tagging-plugin

This plugin is based on the default tagging plugin that comes with Vanilla. Therefore this is vulnerable to the same attack.

Create a new thread and post your XSS as tag. I used
<script>alert('xss')</script>

You will have to use a proxy / manipulate the form to bypass the max-length on the form.

Once you have posted the thread, send an administrator or moderator to

http://target.tld/index.php?p=/vanilla/post/editdiscussion/7

Where 7 is the thread ID of the thread you just made. The XSS will then trigger.
You can even use a URL shortener to send the link.

Note: The URL may be different depending on what category your thread is in.

#############################################################