here is a temporary fix, i have tested this locally only for the donate function and its working as far as this exploit goes, and since the same logic can be taken for other places where its used we can replace there
go to your vbplaza folder, find occurrences of the following:
includes/function_vbplaza.php
find around line 152(depending on the version you have)
PHP Code:
$message = strip_tags($message);
make that
PHP Code:
$message = htmlspecialchars($message);
go to
vbplaza/action.admindonate.php (line 133)
PHP Code:
$action['reason'] = strip_tags($action['reason']);
make that
PHP Code:
$action['reason'] = htmlspecialchars($action['reason']);
goto
vbplaza/action.changeotherusertitle.php (line 136)
PHP Code:
$newusertitle_stripped = strip_tags($newusertitle);
make that
PHP Code:
$newusertitle_stripped = htmlspecialchars($newusertitle);
goto
vbplaza/action.changeusertitle.php (line 87)
PHP Code:
$newusertitle_stripped = strip_tags($newusertitle);
make that
PHP Code:
$newusertitle_stripped = htmlspecialchars($newusertitle);
goto
vbplaza/action.donate.php (line 164)
PHP Code:
$action['reason'] = strip_tags($action['reason']);
make that
PHP Code:
$action['reason'] = htmlspecialchars($action['reason']);
goto
vbplaza/action.gift.php (line 209)
PHP Code:
$action['giftmessage'] = strip_tags($action['giftmessage']);
make that
PHP Code:
$action['giftmessage'] = htmlspecialchars($action['giftmessage']);
goto
vbplaza/action.ribbons.php (line 218)
PHP Code:
$action['ribbonmessage'] = strip_tags($action['ribbonmessage']);
make that
PHP Code:
$action['ribbonmessage'] = htmlspecialchars($action['ribbonmessage']);
the above fixes one part of the exploit. Ofcourse there might be other issues involved also, i am still looking around and maybe others are also.
Please note that there might be other code areas that can be exploited also which i don't know yet. Don't think you are safe just by doing the above. The full exploit and what caused it has not been released so all this is guesswork to find the vulnerable part.(btw if this was not one part of exploit, even then it should be in part of the fix as the original code above can be exploited.I just looked at the code and saw this cos the original poster had mentioned something to do with pm text. Wait for an official fix or atleast don't blame me :D
More Information