bugtraq - Re: New Include Redirect Bug XSS All vBulletin v 3.x.x

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 21 Jun 2007 20:39:11 +0200 (CEST)
From: kaneda@...ater.net
To: bugtraq@...urityfocus.com
Subject: Re: New Include Redirect Bug XSS All vBulletin v 3.x.x

On Thu, 21 Jun 2007, scott-REMOVE-@...lletin.com wrote:

:] There is a much more significant issue than executing an XSS if you can upload a file to a remote site...

Good Raining morning...

If he has access for example to /tmp directory or other directory on
hosted server (from another normal (maybe ftp) account in another domain),
he still can run XSS via his bug. In this case his domain can be another
domain (but on the same phisical machine) and IMHO vBulletin should check
path traversal.

best regards
Kanedaaa

btw: of course if he can use ../../ to take file from path outside root
path of vBulletin (like /tmp or another account dir)

:] 
:] If this is how you plan to execute the XSS then there is nothing to fix or even do here on our part.
:] 
:] Scott MacVicar
:] Development Team, vBulletin
:] 

-- 
[][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]..
[+] You can take our lives,but you will never take our Freedom - W.Wallace
[+] Peace on earth depends on the peace in the peoples hearts - Dalai Lama
[+] Revolution the only solution - System of a down...
[+] Dalej idac dalej dojdziesz dalej siedzac dalej siedzisz - etoe aka ok0
[-] Kanedaaa... Bohateur... Cucumber Team Member...     kaneda@...ater.net