vBulletin < 3.6.5 .swf ActionScript XSS

Binary data 3869.prm...

vBulletin SWF脚本注入漏洞

vBulletin是一款开放源代码PHP论坛程序。 vBulletin在处理恶意SWF文件时存在漏洞，远程攻击者可能利用此漏洞获取用户机器的敏感信息。 如果攻击者能够向vBulletin上传包含有恶意actionscript帧的SWF文件的话，就可能执行跨站脚本攻击，导致在日志文件中泄露基于cookie的认证凭据。 VBulletin VBulletin = 3.6.4 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.vbulletin.com/ getURL"javascript:function blabvar...

XSS with Vbulletin &#40;new idea !&#41;

Author : Ashraf Morad Contact : [email protected] XSS with vBulletin Attachments supported , SWF is a valid extension ! Materials : -Any SWF file with an actionscript frame : ActionScript Code : getURL"javascript:function blabvar scriptNode =...

vBulletin 3.5.x3.6.x - SWF Script Injection

vBulletin 3.5.x3.6.x - SWF Script Injection source: https://www.securityfocus.com/bid/21736/info vBulletin is prone to a vulnerability that may let remote attackers inject arbitrary script code into the application. If exploited, this vulnerability may let attackers steal cookie-based...

vBulletin 3.5.x/3.6.x - SWF Script Injection

source: https://www.securityfocus.com/bid/21736/info vBulletin is prone to a vulnerability that may let remote attackers inject arbitrary script code into the application. If exploited, this vulnerability may let attackers steal cookie-based authentication credentials. Other attacks are also...

PT-2006-6687 · Vbulletin Solutions · Vbulletin

Name of the Vulnerable Software and Affected Versions: vBulletin versions 3.6.x Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the prefs parameter in a "buildnavprefs" action ...

CVE-2006-6040

CVE-2006-6040 affects Jelsoft vBulletin 3.6.x, specifically admincp/index.php. The vulnerability is due to cross-site scripting (XSS) via two parameters: prefs in a buildnavprefs action and navprefs in a savenavprefs action, enabling remote attackers to inject arbitrary script/HTML. Public refere...

CVE-2006-6040

Multiple cross-site scripting XSS vulnerabilities in admincp/index.php in Jelsoft vBulletin 3.6.x allow remote attackers to inject arbitrary web script or HTML via 1 the prefs parameter in a buildnavprefs action or 2 the navprefs parameter in a savenavprefs action...

vBulletin 3.6.x - Admin Control Panel Multiple Cross-Site Scripting Vulnerabilities

vBulletin 3.6.x - Admin Control Panel Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/21157/info vBulletin is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data. An attacker could exploi...

vBulletin 3.6.x - Admin Control Panel Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/21157/info vBulletin is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data. An attacker could exploit this vulnerability to have arbitrary script code execute in the context of the...

vbull-dos.txt

VBulletin DoS Exploit by www.h4x0r.ir The exploit was tested on 15 machines And 13 of them got Crashed. 98% Works ; important = Image Verification in search.php is NOT Enabled. It works on 3.6.3 and prior all ! Perl Script use Socket; if @ARGV /...

vbulletin361.txt

Author: insanity E-mail: [email protected] XSS vBulletin 3.6.1 Admin Control Panel http://www.exemplo.com/vbulletin/admincp/index.php?do=buildnavprefs&nojs=0&prefs="alert"insanity" http://www.exemplo.com/vbulletin/admincp/index.php?do=savenavprefs&nojs=0&navprefs="alert"insanity"...

vBulletin恶意附件IE跨站脚本执行漏洞

vBulletin是一款开放源代码PHP论坛程序。 Microsoft IE在处理vBulletin的附件时存在漏洞，远程攻击者可能利用此漏洞在用户机器上执行恶意代码。 远程攻击者可以将恶意代码保存为.pdf文件并在张贴时做为附件上传到论坛，这样用户在IE中打开附件时就会导致执行任意代码。 VBulletin VBulletin 3.5.4 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.vbulletin.com/...

vbulletin Exploit Tool Box

No description provided by source. include unistd.h include stdio.h include stdlib.h include sys/types.h include sys/socket.h include netinet/in.h include netdb.h include arpa/inet.h include errno.h include string.h include iostream using namespace std; string exploit; string answer; string...

vb-sploitbox.txt

This Box continue the 3 vbulletin exploits, under it you can use the vbulletin install path exploit, the other two exploits can be only watched. Code: include include include include include include include include include include include using namespace std; string exploit; string answer; string...

CVE-2006-5104

SQL injection vulnerability in global.php in Jelsoft vBulletin 2.x allows remote attackers to execute arbitrary SQL commands via the templatesused parameter...

Vbulletin-2.x.txt

Hello,, Vbulletin 2.X sql injection Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] This is sql injection in vbulletin systems the injection is in the global.php file we can use it global.php?templatesused=/ the query will be...

CVE-2006-5104

SQL injection vulnerability in global.php in Jelsoft vBulletin 2.x allows remote attackers to execute arbitrary SQL commands via the templatesused parameter...

CVE-2006-5104

The CVE-2006-5104 entry concerns Jelsoft vBulletin 2.x, where a SQL injection vulnerability exists in the global.php handling of the templatesused parameter. The underlying issue allows remote attackers to craft input that leads to arbitrary SQL execution, as reported in multiple sources (NVD ent...

Vbulletin 2.X sql injection

Hello,, Vbulletin 2.X sql injection Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] This is sql injection in vbulletin systems the injection is in the global.php file we can use it global.php?templatesused=/ the query will be...