vBulletin 2.2.7/2.2.8 – HTML Injection

vBulletin 2.2.7/2.2.8 – HTML Injection

漏洞ID 1053639 漏洞类型
发布时间 2002-11-09 更新时间 2002-11-09
图片[1]-vBulletin 2.2.7/2.2.8 – HTML Injection-安全小百科CVE编号 N/A
图片[2]-vBulletin 2.2.7/2.2.8 – HTML Injection-安全小百科CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/22077
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/6337/info

Problems with vBulletin could make it possible for an attacker to inject arbitrary HTML in vBulletin forum messages.

vBulletin does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user chooses to view a message posting that contains malicious HTML code, the code contained in the message would be executed in the browser of the vulnerable user. This will occur in the context of the site hosting the vBulletin forum software.

Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

This should only be considered an issue if HTML has been enabled in messages. This option is not enabled by default and the vendor recommends that users do not enable it. If the option has been enabled, HTML will not be filtered at all.

*** This vulnerability has been further investigated. It has been reported by the vendor that this functionality is by disabled by default. Additionally, the risks of enabling this feature are documented in the user manual. Therefore, this is not a valid vulnerability, and will be removed from the SecurityFocus Vulnerability Database.

<b onMouseOver="alert(document.location);">Test!</b>

相关推荐: Berkeley Parallel Make Buffer Overflow Vulnerability

Berkeley Parallel Make Buffer Overflow Vulnerability 漏洞ID 1102760 漏洞类型 Boundary Condition Error 发布时间 2001-11-21 更新时间 2001-11-21 CV…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享