header-logo
Suggest Exploit
vendor:
Vanilla Version 2.0.18.4 + Latest Comment 1.1
by:
Henry Hoggard
8,8
CVSS
HIGH
Persistant XSS
79
CWE
Product Name: Vanilla Version 2.0.18.4 + Latest Comment 1.1
Affected Version From: 2.0.18.4
Affected Version To: 2.0.18.4
Patch Exists: No
Related CWE: N/A
CPE: vanillaforums.org/addon/latestcomment-plugin
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2012

Vanilla LatestComment 1.1 Plugin Persistant XSS Vulnerability

A persistent XSS vulnerability exists in Vanilla Version 2.0.18.4 + Latest Comment 1.1 plugin. An attacker can create a new thread with an XSS payload as the thread title, which will appear on the index page of the forum.

Mitigation:

Ensure that user input is properly sanitized and validated before being displayed on the page.
Source

Exploit-DB raw data:

# Title: Vanilla LatestComment 1.1 Plugin Persistant XSS Vulnerability
# Date: 18/5/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# Software: Vanilla Version 2.0.18.4 + Latest Comment 1.1

#http://vanillaforums.org/addon/latestcomment-plugin

# http://vanillaforums.org
#############################################################

Create a new thread with your XSS as the thread title, the XSS will appear on the index page of the forum.

XSS:
<script>alert('x')</script>

#############################################################

http://henryhoggard.co.uk

Navigation

Suggest Exploit

Services By CQR