vBulletin 2.2.7/2.2.8 – HTML Injection
漏洞ID | 1053639 | 漏洞类型 | |
发布时间 | 2002-11-09 | 更新时间 | 2002-11-09 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | PHP | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/6337/info
Problems with vBulletin could make it possible for an attacker to inject arbitrary HTML in vBulletin forum messages.
vBulletin does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user chooses to view a message posting that contains malicious HTML code, the code contained in the message would be executed in the browser of the vulnerable user. This will occur in the context of the site hosting the vBulletin forum software.
Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.
This should only be considered an issue if HTML has been enabled in messages. This option is not enabled by default and the vendor recommends that users do not enable it. If the option has been enabled, HTML will not be filtered at all.
*** This vulnerability has been further investigated. It has been reported by the vendor that this functionality is by disabled by default. Additionally, the risks of enabling this feature are documented in the user manual. Therefore, this is not a valid vulnerability, and will be removed from the SecurityFocus Vulnerability Database.
<b onMouseOver="alert(document.location);">Test!</b>
相关推荐: Berkeley Parallel Make Buffer Overflow Vulnerability
Berkeley Parallel Make Buffer Overflow Vulnerability 漏洞ID 1102760 漏洞类型 Boundary Condition Error 发布时间 2001-11-21 更新时间 2001-11-21 CV…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666