XSS In All The Versions Of Vbulletin

[HizbullaH]

I Was Checking The Latest Exploits.
And I Found An Exploit For All The Versions Of Vbulletin!
The Exploit Is Somehow Complicated, But It Will Allow You Steal Cookies Through XSS.
Its Idea Is To Inject Somethings To A Spacer PNG Image Using The Perl Programming Language And Then Uploading It To The Site (Avatar For Example), Then Injecting The Evil Codes.
I Didn't Apply This Exploit And I Didn't Read It All Because Of The Small Free Time.
But I Think Vcoderz And Other Sites Were Hacked In This Way!

~!~ We Are HizbullaH Rockets On The Net ~!~

[Jean]

Originally Posted by HizbullaH

I Was Checking The Latest Exploits.
And I Found An Exploit For All The Versions Of Vbulletin!
The Exploit Is Somehow Complicated, But It Will Allow You Steal Cookies Through XSS.
Its Idea Is To Inject Somethings To A Spacer PNG Image Using The Perl Programming Language And Then Uploading It To The Site (Avatar For Example), Then Injecting The Evil Codes.
I Didn't Apply This Exploit And I Didn't Read It All Because Of The Small Free Time.
But I Think Vcoderz And Other Sites Were Hacked In This Way!

~!~ We Are HizbullaH Rockets On The Net ~!~

clarification : vcoderz.com wasn't hacked , there was an attack against the forum, but they didn't succeed in any thing.

[god]

double clarification: Vcoderz was hacked by me several times :P
Bas hizbullah uploading it as an avatar wont work, cuz images are parsed into bytes and inserted in vbulletin's database, and displayed not like normal images, so it wont work

[lebanese_a]

Originally Posted by god

double clarification: Vcoderz was hacked by me several times :P

the forum aw the site?7777777777777777777777777

[god]

both, anyway lets not drift off topic...

[Dazlingo]

ROFL :P
im not sure about that vb feature ur talking about. last time i checked, the Pictures are stored as is , and the link to them is in the DB, so they can be used.