ثغره جديده { Vanilla Forums About Me Plugin Persistant XSS }

[اخلاقي تاج راسي]

بسم الله الرحمن الرحيم

 # Title: Vanilla About Me Plugin Persistant XSS Vulnerability 
# Date: 18/5/12 
# Author: Henry Hoggard 
# Author URL: henryhoggard.co.uk 
# Author Twitter: @henryhoggard 
# Software: Vanilla Version 2.0.18.4 + About Me 1.1.1 
# http://vanillaforums.org/addon/aboutme-plugin 
# http://http://vanillaforums.org 
############################################################# 
  
Go to http://target.tld/index.php?p=/profile/editme/4/testmember 
  
Post your XSS In any of the text fields, for this we used the Real Name Field and the following XSS 
  
XSS: 
**********alert('x')</script> 
  
Then if a user visits your about me page (http://target.tld/index.php?p=/profile/aboutme/4/testmember) the script will execute 
  
############################################################# 
  
http://henryhoggard.co.uk  

رابط الثغره : http://www.exploit-db.com/exploits/18911




تحيآتي