|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: VBulletin AdminCP Index.PHP Multiple Cross-Site Scripting Vulnerability
kier
vbulletin.com
Date: Wed Feb 07 2007 - 04:23:01 CST
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
I'm somewhat surprised that the reporter does not list the HTML template editor as a potential XSS attack vector too. Perhaps he considers uploading files via FTP to be a means of attack too?
Yes, we allow *authenticated administrators* to enter HTML for certain values. This is the intended behaviour, and should the authenticated site administrator wish to include <script> tags in that HTML that is their perogative.
This is not a bug or a security flaw.
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]