Vanilla Tagging Stored XSS

vendor:

Vanilla Forums

by:

Henry Hoggard

8,8

CVSS

HIGH

Stored XSS

CWE

Product Name: Vanilla Forums

Affected Version From: 2.0.18.4

Affected Version To: 2.0.18.4

Patch Exists: YES

Related CWE: N/A

CPE: a:vanilla_forums:vanilla_forums:2.0.18.4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Vanilla Version 2.0.18.4 is vulnerable to stored XSS. An attacker can create a new thread and post their XSS as a tag. The attacker can bypass the max-length on the form by using a proxy or manipulating the form. Once the thread is posted, an administrator or moderator can be sent to the URL http://server/index.php?p=/vanilla/post/editdiscussion/7, where 7 is the thread ID of the thread just made. The XSS will then trigger. The URL may be different depending on what category the thread is in.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in the application.

Source

Exploit-DB raw data:

# Title: Vanilla Tagging Stored XSS
# Date: 1/6/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# Software: Vanilla Version 2.0.18.4
# http://vanillaforums.org/download

Create a new thread and post your XSS as tag. I used
<script>alert('xss')</script>

You will have to use a proxy / manipulate the form to bypass the max-length on the form.

Once you have posted the thread, send an administrator or moderator to

http://server/index.php?p=/vanilla/post/editdiscussion/7

Where 7 is the thread ID of the thread you just made. The XSS will then trigger.
You can even use a URL shortener to send the link.

Note: The URL may be different depending on what category your thread is in.

#############################################################